hxxp://arc[.]net

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSATRestorePower = "powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"	WinSat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSATRestorePower = "powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"	WinSat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSATRestorePower = "powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"	WinSat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sidebar = "C:\\Program Files\\Windows Sidebar\\sidebar.exe /autoRun"	sidebar.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini	solitaire.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft Games\Solitaire\desktop.ini	solitaire.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	WinSat.exe
File opened (read-only)	\??\F:	WinSat.exe
File opened (read-only)	\??\F:	WinSat.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	WinSat.exe
File opened for modification	C:\Windows\Performance\WinSAT\winsat.log	WinSat.exe
File opened for modification	C:\Windows\Performance\WinSAT\winsat.log	WinSat.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	WinSat.exe
File opened for modification	C:\Windows\WindowsUpdate.log	ehshell.exe
File opened for modification	C:\Windows\setuperr.log	WinSat.exe
File opened for modification	C:\Windows\setupact.log	WinSat.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	WinSat.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\setupact.log	WinSat.exe
File opened for modification	C:\Windows\setuperr.log	WinSat.exe
File opened for modification	C:\Windows\setuperr.log	WinSat.exe
File opened for modification	C:\Windows\Performance\WinSAT\winsat.log	WinSat.exe
File opened for modification	C:\Windows\setupact.log	WinSat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	2400	WerFault.exe	36

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WinSat.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ehshell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	ehshell.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WinSat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	ehshell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WinSat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ehshell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WinSat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WinSat.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WinSat.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 70afb6ef99b4da01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Height = "21"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c04a68f8f2635748b7196af821ba485e0000000002000000000010660000000100002000000062f1aa17429a34546e52d67501fbe6c39cef20b51a41b4d79cdcc7a63b8f96c3000000000e8000000002000020000000ac2dbced7207cdaead303786e0ae0832d86ff55587483e62e786b1fefc58ad4b900000005b1d01c9e6cab00b3497ef289b268ac63c35814b3b2c0b11f32e98d1e26af1c74af348b7e0517810d7f560e7ce41214237abed98400ee227c075944a61a7b23aa5aef1694f18edcdde27f67d1863415ff34d37605a929080b4f30d97cf059ecee28bacd9d8bfe0772a3bf71b9d1b50291afd83f95edda29d246c1de6343c2a10c56a8e6a946643a0fbe13167607b8a0240000000b247f7279a106f6a256ab833ceca85fdbebdf64df9ec95bdc408eabba3d0afa01b2ff161ba0fb0f114bfa52d7ccfd551aab64e025bf3cd1e80072376beb26e03	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 5046e8dd99b4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301ad9a799b4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://www.facebook.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Height = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url7 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c04a68f8f2635748b7196af821ba485e00000000020000000000106600000001000020000000d70d79ead64ac4c79bef9db76b27bc7df1d67f9af7794b4734021f54711bd0c7000000000e80000000020000200000009272994a2b4ab4f6b628dd48cb6fca5f4b3891e8518a94c0ddf1fb4c68ae1a4d200000009c4aaa8290a5316d00ab8c576ade22d332c473ad37d439e01528eb3c30d273f340000000a6d5da4e1a25c41850087aa8e51c7f60798647886ef6fbeec49e88165f6d2ea086f67625b26bddfe5aca8c0b077b770f3c4b1f6d2b92cfdf48abde10bac108a2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	sidebar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "http://roblox.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D17523C1-208C-11EF-8AAC-6EAD7206CC74} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://roblox.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 5046e8dd99b4da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs\url7 = "https://twitter.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423459333"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows	solitaire.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}\LastPlayed = "0"	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings	solitaire.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2340	iexplore.exe
2400	WinSat.exe
2000	WinSat.exe
1648	WinSat.exe
3760	ehshell.exe
1304	sidebar.exe
3596	chrome.exe
3596	chrome.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3760	ehshell.exe
3540	solitaire.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2400	WinSat.exe
Token: SeRestorePrivilege	2400	WinSat.exe
Token: SeRestorePrivilege	2400	WinSat.exe
Token: SeRestorePrivilege	2400	WinSat.exe
Token: SeRestorePrivilege	2400	WinSat.exe
Token: SeRestorePrivilege	2400	WinSat.exe
Token: SeRestorePrivilege	2400	WinSat.exe
Token: SeRestorePrivilege	2000	WinSat.exe
Token: SeRestorePrivilege	2000	WinSat.exe
Token: SeRestorePrivilege	2000	WinSat.exe
Token: SeRestorePrivilege	2000	WinSat.exe
Token: SeRestorePrivilege	2000	WinSat.exe
Token: SeRestorePrivilege	2000	WinSat.exe
Token: SeRestorePrivilege	2000	WinSat.exe
Token: SeRestorePrivilege	1648	WinSat.exe
Token: SeRestorePrivilege	1648	WinSat.exe
Token: SeRestorePrivilege	1648	WinSat.exe
Token: SeRestorePrivilege	1648	WinSat.exe
Token: SeRestorePrivilege	1648	WinSat.exe
Token: SeRestorePrivilege	1648	WinSat.exe
Token: SeRestorePrivilege	1648	WinSat.exe
Token: SeDebugPrivilege	1480	firefox.exe
Token: SeDebugPrivilege	1480	firefox.exe
Token: SeDebugPrivilege	1464	firefox.exe
Token: SeDebugPrivilege	1464	firefox.exe
Token: SeDebugPrivilege	3760	ehshell.exe
Token: SeShutdownPrivilege	3760	ehshell.exe
Token: SeDebugPrivilege	1304	sidebar.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe
Token: SeShutdownPrivilege	3596	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2028	msdt.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
1304	sidebar.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
2340	iexplore.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1480	firefox.exe
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe

Suspicious use of SetWindowsHookEx 42 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2340	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
2340	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
1464	firefox.exe
1464	firefox.exe
1464	firefox.exe
3232	WISPTIS.EXE
3192	SnippingTool.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
3000	mspaint.exe
3000	mspaint.exe
3000	mspaint.exe
3000	mspaint.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
4748	IEXPLORE.EXE
4748	IEXPLORE.EXE
4748	IEXPLORE.EXE
4748	IEXPLORE.EXE
2340	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2736	2340	iexplore.exe	28
PID 2340 wrote to memory of 2736	2340	iexplore.exe	28
PID 2340 wrote to memory of 2736	2340	iexplore.exe	28
PID 2340 wrote to memory of 2736	2340	iexplore.exe	28
PID 2340 wrote to memory of 1940	2340	iexplore.exe	35
PID 2340 wrote to memory of 1940	2340	iexplore.exe	35
PID 2340 wrote to memory of 1940	2340	iexplore.exe	35
PID 2340 wrote to memory of 1940	2340	iexplore.exe	35
PID 2340 wrote to memory of 2400	2340	iexplore.exe	36
PID 2340 wrote to memory of 2400	2340	iexplore.exe	36
PID 2340 wrote to memory of 2400	2340	iexplore.exe	36
PID 2340 wrote to memory of 2400	2340	iexplore.exe	36
PID 2400 wrote to memory of 1860	2400	Guilded-Win.exe	37
PID 2400 wrote to memory of 1860	2400	Guilded-Win.exe	37
PID 2400 wrote to memory of 1860	2400	Guilded-Win.exe	37
PID 2400 wrote to memory of 1860	2400	Guilded-Win.exe	37
PID 2068 wrote to memory of 2580	2068	sdiagnhost.exe	43
PID 2068 wrote to memory of 2580	2068	sdiagnhost.exe	43
PID 2068 wrote to memory of 2580	2068	sdiagnhost.exe	43
PID 2580 wrote to memory of 2504	2580	csc.exe	44
PID 2580 wrote to memory of 2504	2580	csc.exe	44
PID 2580 wrote to memory of 2504	2580	csc.exe	44
PID 2068 wrote to memory of 2440	2068	sdiagnhost.exe	45
PID 2068 wrote to memory of 2440	2068	sdiagnhost.exe	45
PID 2068 wrote to memory of 2440	2068	sdiagnhost.exe	45
PID 2440 wrote to memory of 2560	2440	csc.exe	46
PID 2440 wrote to memory of 2560	2440	csc.exe	46
PID 2440 wrote to memory of 2560	2440	csc.exe	46
PID 2068 wrote to memory of 608	2068	sdiagnhost.exe	47
PID 2068 wrote to memory of 608	2068	sdiagnhost.exe	47
PID 2068 wrote to memory of 608	2068	sdiagnhost.exe	47
PID 608 wrote to memory of 1368	608	csc.exe	48
PID 608 wrote to memory of 1368	608	csc.exe	48
PID 608 wrote to memory of 1368	608	csc.exe	48
PID 2068 wrote to memory of 2400	2068	sdiagnhost.exe	49
PID 2068 wrote to memory of 2400	2068	sdiagnhost.exe	49
PID 2068 wrote to memory of 2400	2068	sdiagnhost.exe	49
PID 2068 wrote to memory of 2000	2068	sdiagnhost.exe	50
PID 2068 wrote to memory of 2000	2068	sdiagnhost.exe	50
PID 2068 wrote to memory of 2000	2068	sdiagnhost.exe	50
PID 2472 wrote to memory of 2664	2472	sdiagnhost.exe	53
PID 2472 wrote to memory of 2664	2472	sdiagnhost.exe	53
PID 2472 wrote to memory of 2664	2472	sdiagnhost.exe	53
PID 2664 wrote to memory of 872	2664	csc.exe	54
PID 2664 wrote to memory of 872	2664	csc.exe	54
PID 2664 wrote to memory of 872	2664	csc.exe	54
PID 2472 wrote to memory of 2564	2472	sdiagnhost.exe	55
PID 2472 wrote to memory of 2564	2472	sdiagnhost.exe	55
PID 2472 wrote to memory of 2564	2472	sdiagnhost.exe	55
PID 2564 wrote to memory of 2392	2564	csc.exe	56
PID 2564 wrote to memory of 2392	2564	csc.exe	56
PID 2564 wrote to memory of 2392	2564	csc.exe	56
PID 2472 wrote to memory of 2512	2472	sdiagnhost.exe	57
PID 2472 wrote to memory of 2512	2472	sdiagnhost.exe	57
PID 2472 wrote to memory of 2512	2472	sdiagnhost.exe	57
PID 2512 wrote to memory of 2440	2512	csc.exe	58
PID 2512 wrote to memory of 2440	2512	csc.exe	58
PID 2512 wrote to memory of 2440	2512	csc.exe	58
PID 2472 wrote to memory of 1648	2472	sdiagnhost.exe	59
PID 2472 wrote to memory of 1648	2472	sdiagnhost.exe	59
PID 2472 wrote to memory of 1648	2472	sdiagnhost.exe	59
PID 2028 wrote to memory of 2104	2028	msdt.exe	60
PID 2028 wrote to memory of 2104	2028	msdt.exe	60
PID 2028 wrote to memory of 2104	2028	msdt.exe	60

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://arc.net
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:537630 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1940
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UA1HZF3D\Guilded-Win.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UA1HZF3D\Guilded-Win.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 384
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:1127450 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:3552296 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:1782836 /prefetch:2
  2⤵
  PID:5036

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:268

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1256

C:\Windows\system32\msdt.exe
"C:\Windows\system32\msdt.exe" -id AeroDiagnostic
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\System32\control.exe
  "C:\Windows\System32\control.exe" /name Microsoft.Troubleshooting /page "resultPage?keywords=Desktop Experience+Aero;AeroDiagnostic"
  2⤵
  PID:2104

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qq-_jdda.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2897.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2896.tmp"
    3⤵
    PID:2504
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wy6dfecy.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES28E5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC28E4.tmp"
    3⤵
    PID:2560
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bwn9dblb.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2953.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2952.tmp"
    3⤵
    PID:1368
- C:\Windows\system32\WinSat.exe
  "C:\Windows\system32\WinSat.exe" features -xml features.xml
  2⤵
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\system32\WinSat.exe
  "C:\Windows\system32\WinSat.exe" features -xml features.xml
  2⤵
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xqpz8fmm.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES39D6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC39D5.tmp"
    3⤵
    PID:872
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nylpqzus.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A44.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3A43.tmp"
    3⤵
    PID:2392
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wtqydvs5.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3AC0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3ABF.tmp"
    3⤵
    PID:2440
- C:\Windows\system32\WinSat.exe
  "C:\Windows\system32\WinSat.exe" features -xml features.xml
  2⤵
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1648

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:944

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" werconcpl.dll, LaunchErcApp -queuereporting
1⤵
PID:1552

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1704
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.0.412957250\1024925249" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1228 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9c30ae3-6e58-4d3f-8e63-44f0af5568f3} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 1312 102c0958 gpu
    3⤵
    PID:2556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.1.446188853\125143746" -parentBuildID 20221007134813 -prefsHandle 1476 -prefMapHandle 1472 -prefsLen 20830 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4a3a052-2b55-40e3-a930-e27e77ffabc5} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 1504 e71f58 socket
    3⤵
    - Checks processor information in registry
    PID:2420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.2.828543774\502612238" -childID 1 -isForBrowser -prefsHandle 2064 -prefMapHandle 2060 -prefsLen 20868 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e2624a5-7f8f-4819-8358-496d8e95a8a1} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 2076 1a18a058 tab
    3⤵
    PID:3052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.3.1576941305\2095274673" -childID 2 -isForBrowser -prefsHandle 764 -prefMapHandle 1668 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70df3e78-c24f-450e-8323-dc7cd44a1fbb} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 752 1bbd8758 tab
    3⤵
    PID:1572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.4.257889121\1852184539" -childID 3 -isForBrowser -prefsHandle 1668 -prefMapHandle 2700 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {488db822-58f0-4710-a5e8-44e4d38e6a8a} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 2832 e5b258 tab
    3⤵
    PID:892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.5.2023786871\870447583" -childID 4 -isForBrowser -prefsHandle 3780 -prefMapHandle 3776 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {495ca2ff-2385-46e5-9b42-24bbb2b2d23a} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 3792 1e6d7e58 tab
    3⤵
    PID:1496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.6.873251953\1207933245" -childID 5 -isForBrowser -prefsHandle 3892 -prefMapHandle 3896 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d03b2d84-9f78-4d7b-83ca-95ed750b8e01} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 3880 1e6da258 tab
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1480.7.1464847837\1703297195" -childID 6 -isForBrowser -prefsHandle 4068 -prefMapHandle 4072 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 884 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abf45a90-3b01-4291-8048-ed69e04b24ff} 1480 "\\.\pipe\gecko-crash-server-pipe.1480" 4056 1e6d9358 tab
    3⤵
    PID:1564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:1268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1464
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1464.0.1244965739\708433496" -parentBuildID 20221007134813 -prefsHandle 1100 -prefMapHandle 1092 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b4d2ea7-897c-4fd0-8cb0-61f5c3837d61} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" 1164 43d5958 gpu
        5⤵
        
        PID:2944
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1464.1.1743055855\353771260" -parentBuildID 20221007134813 -prefsHandle 1320 -prefMapHandle 1316 -prefsLen 17601 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8486eff1-ce83-4608-b060-f35bf801b79b} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" 1332 11a71a58 socket
        5⤵
        
        PID:2104
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1464.2.2027608066\1548801904" -childID 1 -isForBrowser -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 23700 -prefMapSize 230321 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {84178045-2cc1-4724-9ada-a2e1074d388c} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" 2408 1b127b58 tab
        5⤵
        
        PID:1648
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1464.3.1899667027\284633701" -childID 2 -isForBrowser -prefsHandle 2676 -prefMapHandle 2696 -prefsLen 23807 -prefMapSize 230321 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfadf288-237f-41cc-95a4-e357538b5caa} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" 2664 1b126c58 tab
        5⤵
        
        PID:496
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1464.4.283591926\430174432" -childID 3 -isForBrowser -prefsHandle 2824 -prefMapHandle 2820 -prefsLen 24889 -prefMapSize 230321 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a19803f5-ec9c-4a7d-a039-8760a0345f01} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" 2900 1d588058 tab
        5⤵
        
        PID:1576
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1464.5.1809613589\1728665765" -parentBuildID 20221007134813 -prefsHandle 2740 -prefMapHandle 2920 -prefsLen 25916 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fb4c91d-2645-4659-b80c-0bd39a188399} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" 3096 1f991f58 rdd
        5⤵
        
        PID:1976
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1464.6.261436909\1473914574" -childID 4 -isForBrowser -prefsHandle 1816 -prefMapHandle 1796 -prefsLen 32055 -prefMapSize 230321 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e11b0ddb-ca87-4aac-a6d1-52d361408329} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" 3648 1d8c4258 tab
        5⤵
        
        PID:2268
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1464.7.1158413723\282638226" -childID 5 -isForBrowser -prefsHandle 3848 -prefMapHandle 3852 -prefsLen 31979 -prefMapSize 230321 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87eb6f45-e00d-41f8-a793-b6cf0adfbcd2} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" 3836 2085e158 tab
        5⤵
        
        PID:1936
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1464.8.864802179\338726011" -childID 6 -isForBrowser -prefsHandle 3960 -prefMapHandle 3968 -prefsLen 31979 -prefMapSize 230321 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {15c72263-84c9-4c4a-bed4-228aa662db9d} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" 3944 2085ff58 tab
        5⤵
        
        PID:2596
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1464.9.338259277\1562199788" -childID 7 -isForBrowser -prefsHandle 4280 -prefMapHandle 4288 -prefsLen 32348 -prefMapSize 230321 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e57cf0f0-ca4e-4c7b-ae73-62a6f578236a} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" 4304 d60158 tab
        5⤵
        
        PID:2416
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1464.10.170812739\353038663" -childID 8 -isForBrowser -prefsHandle 3184 -prefMapHandle 3388 -prefsLen 33474 -prefMapSize 230321 -jsInitHandle 820 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3be9905-e2e1-4a2c-99bb-3fcc2c88e5b2} 1464 "\\.\pipe\gecko-crash-server-pipe.1464" 3176 1b00e358 tab
        5⤵
        
        PID:3088

C:\Windows\system32\SnippingTool.exe
"C:\Windows\system32\SnippingTool.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3192
- C:\Windows\SYSTEM32\WISPTIS.EXE
  "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3232

C:\Windows\ehome\ehshell.exe
"C:\Windows\ehome\ehshell.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Program Files\Microsoft Games\solitaire\solitaire.exe
"C:\Program Files\Microsoft Games\solitaire\solitaire.exe"
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3540

C:\Program Files\Windows Sidebar\sidebar.exe
"C:\Program Files\Windows Sidebar\sidebar.exe" /showGadgets
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1304

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3000

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
1⤵
PID:3508
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
  2⤵
  PID:1224

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut
1⤵
PID:4084

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fee8f29758,0x7fee8f29768,0x7fee8f29778
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2164 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2172 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1380 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:2
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1248 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3480 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3592 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3708 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=1324,i,10337628892895076240,7871698747227397016,131072 /prefetch:8
  2⤵
  PID:4968

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery