wannacry | 87dd443a0684592f55e952d5ead17152ffc8fe342a6b5bf446ce5651dbd45f11

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe

Suspicious use of NtCreateProcessExOtherParentProcess 10 IoCs

Processes:

taskmgr.exetaskmgr.exe

description	pid	process	target process
PID 6080 created 4400	6080	taskmgr.exe	FA AntiVira Prosses Watch.exe
PID 6080 created 4400	6080	taskmgr.exe	FA AntiVira Prosses Watch.exe
PID 6080 created 4400	6080	taskmgr.exe	FA AntiVira Prosses Watch.exe
PID 6080 created 4400	6080	taskmgr.exe	FA AntiVira Prosses Watch.exe
PID 6080 created 4400	6080	taskmgr.exe	FA AntiVira Prosses Watch.exe
PID 6080 created 4400	6080	taskmgr.exe	FA AntiVira Prosses Watch.exe
PID 6080 created 4400	6080	taskmgr.exe	FA AntiVira Prosses Watch.exe
PID 6080 created 4400	6080	taskmgr.exe	FA AntiVira Prosses Watch.exe
PID 4716 created 4400	4716	taskmgr.exe	FA AntiVira Prosses Watch.exe
PID 4716 created 4400	4716	taskmgr.exe	FA AntiVira Prosses Watch.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

Processes:

[email protected]

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD5A32.tmp	[email protected]
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD5A39.tmp	[email protected]

Executes dropped EXE 64 IoCs

Processes:

taskdl.exe@[email protected]@[email protected]taskhsvc.exetaskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exefatalerror.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]

pid	process
6016	taskdl.exe
5144	@[email protected]
5644	@[email protected]
4984	taskhsvc.exe
6132	taskdl.exe
372	taskse.exe
4996	@[email protected]
540	taskdl.exe
5396	taskse.exe
6008	@[email protected]
5552	taskse.exe
5864	@[email protected]
3524	taskdl.exe
764	taskse.exe
372	@[email protected]
5020	taskdl.exe
6004	taskse.exe
4924	@[email protected]
1580	taskdl.exe
5732	taskse.exe
664	@[email protected]
2460	taskdl.exe
5420	taskse.exe
1968	@[email protected]
4712	taskdl.exe
6012	fatalerror.exe
3272	taskse.exe
2156	@[email protected]
384	taskdl.exe
6132	taskse.exe
5732	@[email protected]
4520	taskdl.exe
1144	taskse.exe
4888	@[email protected]
1496	taskdl.exe
2156	taskse.exe
1776	@[email protected]
876	taskdl.exe
5516	taskse.exe
4752	@[email protected]
5196	taskdl.exe
5492	taskse.exe
5972	@[email protected]
1712	taskdl.exe
6128	taskse.exe
5640	@[email protected]
3540	taskdl.exe
4288	taskse.exe
6052	@[email protected]
3200	taskdl.exe
5336	taskse.exe
5524	@[email protected]
4424	taskdl.exe
3824	taskse.exe
5808	@[email protected]
756	taskdl.exe
5764	taskse.exe
824	@[email protected]
3152	taskdl.exe
4632	taskse.exe
2168	@[email protected]
1468	taskdl.exe
2964	taskse.exe
1744	@[email protected]

Loads dropped DLL 64 IoCs

Processes:

FA AntiVira Prosses Watch.exetaskhsvc.exe[email protected]MsiExec.exeMsiExec.exe[email protected]MsiExec.exeMsiExec.exe[email protected]MsiExec.exe

pid	process
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
860	[email protected]
860	[email protected]
5932	MsiExec.exe
5932	MsiExec.exe
5932	MsiExec.exe
5932	MsiExec.exe
5932	MsiExec.exe
5932	MsiExec.exe
5932	MsiExec.exe
5932	MsiExec.exe
5932	MsiExec.exe
5932	MsiExec.exe
4764	MsiExec.exe
5932	MsiExec.exe
860	[email protected]
5932	MsiExec.exe
4768	[email protected]
4768	[email protected]
3604	MsiExec.exe
3604	MsiExec.exe
3604	MsiExec.exe
3604	MsiExec.exe
3604	MsiExec.exe
3604	MsiExec.exe
3604	MsiExec.exe
3604	MsiExec.exe
3604	MsiExec.exe
3604	MsiExec.exe
1156	MsiExec.exe
3604	MsiExec.exe
4768	[email protected]
3604	MsiExec.exe
3796	[email protected]
3796	[email protected]
4716	MsiExec.exe
4716	MsiExec.exe
4716	MsiExec.exe
4716	MsiExec.exe
4716	MsiExec.exe
4716	MsiExec.exe
4716	MsiExec.exe
4716	MsiExec.exe
4716	MsiExec.exe
4716	MsiExec.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5868 icacls.exe

pid	process
5868	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bbnbuexzwbcz676 = "\"C:\\Users\\Admin\\Desktop\\tasksche.exe\""	reg.exe

Blocklisted process makes network request 4 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exe

flow pid process

233 5932 MsiExec.exe
235 3604 MsiExec.exe
236 4716 MsiExec.exe
242 2692 MsiExec.exe

flow	pid	process
233	5932	MsiExec.exe
235	3604	MsiExec.exe
236	4716	MsiExec.exe
242	2692	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exemsiexec.exe[email protected]msiexec.exe[email protected][email protected]msiexec.exemsiexec.exe[email protected]

description	ioc	process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\B:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	[email protected]
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

163 camo.githubusercontent.com
205 raw.githubusercontent.com
206 raw.githubusercontent.com

flow	ioc
163	camo.githubusercontent.com
205	raw.githubusercontent.com
206	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

[email protected]@[email protected]

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Program Files directory 4 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI7063.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CD0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D22.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D92.tmp	msiexec.exe
File opened for modification	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIC1B1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B6F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70A3.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6f4a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DC3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC09E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BF1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C8F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CC0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC130.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1C2.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6f46.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FD2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CA0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8ECF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC160.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D11.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC211.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D00.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D70.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC10F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D21.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70D4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71B3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a6f4f.msi	msiexec.exe
File opened for modification	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI8BE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CC1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1A0.tmp	msiexec.exe
File opened for modification	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\e5a6f46.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7022.tmp	msiexec.exe
File created	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI7202.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC110.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B8F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7105.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7164.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E42.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6f4f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C11.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FF2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7043.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BCF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CF1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D61.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC29F.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a6f54.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BAF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7073.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

Processes:

fatalerror.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\IESettingSync	fatalerror.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	fatalerror.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	fatalerror.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	fatalerror.exe

Modifies data under HKEY_USERS 11 IoCs

Processes:

msiexec.exechrome.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133613829088551727"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 2 IoCs

Processes:

firefox.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2248 reg.exe

pid	process
2248	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

FA AntiVira Prosses Watch.exechrome.exetaskhsvc.exechrome.exemsiexec.exetaskmgr.exetaskmgr.exe

pid	process
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
2928	chrome.exe
2928	chrome.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
4400	FA AntiVira Prosses Watch.exe
2928	chrome.exe
2928	chrome.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
4984	taskhsvc.exe
1604	chrome.exe
1604	chrome.exe
3904	msiexec.exe
3904	msiexec.exe
3904	msiexec.exe
3904	msiexec.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
3904	msiexec.exe
3904	msiexec.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

chrome.exe

pid process

2928 chrome.exe
2928 chrome.exe
2928 chrome.exe
2928 chrome.exe
2928 chrome.exe
2928 chrome.exe
2928 chrome.exe

pid	process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

FA AntiVira Prosses Watch.exefirefox.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	4400	FA AntiVira Prosses Watch.exe
Token: SeDebugPrivilege	2768	firefox.exe
Token: SeDebugPrivilege	2768	firefox.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exechrome.exemsiexec.exemsiexec.exetaskmgr.exe

pid	process
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
1388	msiexec.exe
1388	msiexec.exe
2956	msiexec.exe
2956	msiexec.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exechrome.exetaskmgr.exe

pid	process
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe
6080	taskmgr.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	process
2768	firefox.exe
5144	@[email protected]
5144	@[email protected]
5644	@[email protected]
5644	@[email protected]
4996	@[email protected]
4996	@[email protected]
6008	@[email protected]
5864	@[email protected]
372	@[email protected]
4924	@[email protected]
664	@[email protected]
1968	@[email protected]
6012	fatalerror.exe
6012	fatalerror.exe
6012	fatalerror.exe
2156	@[email protected]
5732	@[email protected]
4888	@[email protected]
1776	@[email protected]
4752	@[email protected]
5972	@[email protected]
5640	@[email protected]
6052	@[email protected]
5524	@[email protected]
5808	@[email protected]
824	@[email protected]
2168	@[email protected]
1744	@[email protected]
2356	@[email protected]
2816	@[email protected]
4288	@[email protected]
6108	@[email protected]
4760	@[email protected]
1160	@[email protected]
3540	@[email protected]
3036	@[email protected]
4504	@[email protected]
2368	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FA AntiVira Prosses Watch.exefirefox.exefirefox.exe

description	pid	process	target process
PID 2236 wrote to memory of 4400	2236	FA AntiVira Prosses Watch.exe	FA AntiVira Prosses Watch.exe
PID 2236 wrote to memory of 4400	2236	FA AntiVira Prosses Watch.exe	FA AntiVira Prosses Watch.exe
PID 2432 wrote to memory of 2768	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 2768	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 2768	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 2768	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 2768	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 2768	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 2768	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 2768	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 2768	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 2768	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 2768	2432	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 3932	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 4688	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 4688	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 4688	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 4688	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 4688	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 4688	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 4688	2768	firefox.exe	firefox.exe
PID 2768 wrote to memory of 4688	2768	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

5152 attrib.exe
3188 attrib.exe

pid	process
5152	attrib.exe
3188	attrib.exe

C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe
"C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe
"C:\Users\Admin\AppData\Local\Temp\FA AntiVira Prosses Watch.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2768.0.724836294\2078883610" -parentBuildID 20230214051806 -prefsHandle 1768 -prefMapHandle 1760 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80b05dd4-2cbc-477e-8195-8745aa1b9668} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" 1852 21bffc24658 gpu
3⤵
PID:3932

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2768.1.1139083600\1705588657" -parentBuildID 20230214051806 -prefsHandle 2392 -prefMapHandle 2380 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afa106c3-f1ff-4b1d-9cf0-5face4bed009} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" 2420 21b8837a158 socket
3⤵
PID:4688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2768.2.1125209160\115695749" -childID 1 -isForBrowser -prefsHandle 2972 -prefMapHandle 2968 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39554f38-e07a-47d1-b8b5-9dad5c3cfce6} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" 2984 21b8a7e5558 tab
3⤵
PID:4220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2768.3.43570504\435765537" -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3680 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e7a1182-ab42-4835-ac4f-2f32c7c4a32c} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" 3688 21b8cf49758 tab
3⤵
PID:916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2768.4.389471986\438742581" -childID 3 -isForBrowser -prefsHandle 5192 -prefMapHandle 5184 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad0d1def-0893-4661-9d1b-e6a7d830ffc3} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" 5204 21b8b181758 tab
3⤵
PID:4484

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2768.5.450645966\1925449070" -childID 4 -isForBrowser -prefsHandle 5208 -prefMapHandle 5200 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bad4924d-c3e3-4064-aa28-45d9625ac3d8} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" 5228 21b8f67e958 tab
3⤵
PID:1872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2768.6.1520122554\1305599689" -childID 5 -isForBrowser -prefsHandle 5340 -prefMapHandle 5440 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d96452a9-e236-4aa8-9a59-2422d30f73a2} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" 5228 21b8f67da58 tab
3⤵
PID:4860

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2768.7.117488992\2048042313" -childID 6 -isForBrowser -prefsHandle 5796 -prefMapHandle 5828 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7553cafb-3ba5-4a0a-a33a-bcbf8766432e} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" 5816 21b8d539258 tab
3⤵
PID:5872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8416bab58,0x7ff8416bab68,0x7ff8416bab78
2⤵
PID:732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:2
2⤵
PID:5320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:2152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:5548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:1
2⤵
PID:5592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:1
2⤵
PID:5616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4356 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:1
2⤵
PID:676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4512 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:5948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:3904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:6076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4772 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:6136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:5316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4676 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:1
2⤵
PID:3904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3160 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:1
2⤵
PID:5028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4888 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:1
2⤵
PID:5556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:5976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:5968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:5768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:4768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:8
2⤵
PID:6108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4532 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:1
2⤵
PID:4300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=2008,i,4249039715988306624,7305931269953781810,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5488

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:5976

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:3188

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:5868

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:6016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 297271716909361.bat
2⤵
PID:4952

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
PID:5184

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- Views/modifies file attributes
PID:5152

C:\Users\Admin\Desktop\@[email protected]
@[email protected] co
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5144

C:\Users\Admin\Desktop\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
2⤵
PID:2580

C:\Users\Admin\Desktop\@[email protected]
@[email protected] vs
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
PID:6012

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
PID:2076

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:6132

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:372

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:4996

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "bbnbuexzwbcz676" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
2⤵
PID:2664

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "bbnbuexzwbcz676" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:2248

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:540

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:5396

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6008

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:5552

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5864

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3524

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:764

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:372

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5020

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:6004

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4924

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1580

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:5732

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:664

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2460

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:5420

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4712

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:3272

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2156

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:384

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:6132

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5732

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4520

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:1144

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1496

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:2156

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1776

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:876

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:5516

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4752

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5196

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:5492

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5972

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1712

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:6128

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5640

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3540

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:4288

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6052

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3200

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:5336

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5524

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4424

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:3824

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5808

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:756

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:5764

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:824

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3152

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:4632

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2168

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1468

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:2964

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
PID:3180

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
PID:3576

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:2356

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
PID:2176

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
PID:4512

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:2816

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
PID:3604

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
PID:2244

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:4288

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
PID:2132

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
PID:1644

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:6108

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
PID:5848

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
PID:880

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:4760

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
PID:6008

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
PID:4508

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:1160

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
PID:1664

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
PID:1320

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:3540

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
PID:5044

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
PID:508

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:3036

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
PID:1388

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
PID:4496

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:4504

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
PID:4772

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
PID:2280

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Suspicious use of SetWindowsHookEx
PID:2368

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
PID:2132

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3824

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
PID:860

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Desktop\[email protected] SETUPEXEDIR=C:\Users\Admin\Desktop\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1388

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3904

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 68C71B68CA76D6BBE7A9E872A34B657E
2⤵
- Loads dropped DLL
- Blocklisted process makes network request
PID:5932

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding BF03720B0520269D6F0ABBB9EE776606 E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4764

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding EEFD6A276473DC1DE1C2311D7BBBBEA3
2⤵
- Loads dropped DLL
- Blocklisted process makes network request
PID:3604

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DCE6566024AA88390B0865BB026127A6 E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1156

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9EC80FD61EC9E10B1781ADB4D2F6513E
2⤵
- Loads dropped DLL
- Blocklisted process makes network request
PID:4716

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 881218F51A2294AEF30DE6472D6D8218 E Global\MSI0000
2⤵
- Drops file in Windows directory
PID:4092

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 84A338754A373E9F570BEB7438A20BB0
2⤵
- Blocklisted process makes network request
PID:2692

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 3D3DFE65607CF844B81A4793BAF6F34D E Global\MSI0000
2⤵
- Drops file in Windows directory
PID:5804

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
PID:4768

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Desktop\[email protected] SETUPEXEDIR=C:\Users\Admin\Desktop\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:2956

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6080

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
PID:3796

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Desktop\[email protected] SETUPEXEDIR=C:\Users\Admin\Desktop\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
2⤵
- Enumerates connected drives
PID:5816

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4716

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Enumerates connected drives
PID:2156

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Desktop\[email protected] SETUPEXEDIR=C:\Users\Admin\Desktop\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
2⤵
- Enumerates connected drives
PID:5132

C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe
"C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe"
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:6012

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f8 0x2f8
1⤵
PID:5804

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

Indicator Removal

T1070

File Deletion

T1070.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery