f19abff1a72b1ef08d57541a0d21908b7bf3ae6797d1bcf08c6a81a7c312393f

Analysis

max time kernel
2612s
max time network
2519s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
engineer-taunt.gif
Size 279KB
Sample240620-2v8gcsvhrq
SHA256 f19abff1a72b1ef08d57541a0d21908b7bf3ae6797d1bcf08c6a81a7c312393f
MD5 8a9e3be06ec8496c7f1a4233876b0697
SHA1 1d29ad9068d227f89009d610d91cca502591bf46
SHA512 f2af39fc536b6b56a485653bfa5b07ea3d3d4a892a1f410c62d13ade46881f321ff79cbfdbf2cfb2a4e82502c24d74ca1ec4bf310d714bdf70c8ddd3ab93ad9b
SSDEEP 6144:4pI6FKD9iEziUIicrzC4CAXJHUqMM4XiU7XQzY0yWjvYM+:4p1oiYozMAWq14SU7gzRjvP+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A9BDDD1-2F58-11EF-A155-FAD28091DCF5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007369f55e9106191beed168a3a0984e3765d5a4bd08bc1a46838b706804f99f66000000000e8000000002000020000000b47b2187c9e308044ae635f51d16211d12c0e840e7990e86e5625115cf4622ac2000000070f3365e62169be60741da1727e8bc6561ebbc94a82af34b9e2d51f4e58840c940000000f77c9cc98931c4ac2164bc749e992b1415ebad9a953c89670c38349e70acbd5407ac9c32a939098bddd336ae805a2f63341dedf59d4746c15ab8d934a531dd7c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000b2a1d335ea37b0dfe4ffe58a3785d89adb34a2d8bef8d943c5842be8b7c14d99000000000e8000000002000020000000d5577a93a038a5bd5b552f4198cb50bf754e187d1f2e345f1c6b23ec7edbaf3a90000000b824661672bb8c9a86adb4d9dda339acb19490a62e9fc06aa75f2982fc02f2ced361db247e5668f6af189c8da311db35e5fccda3435713a6dc4a1725f571af4f950fcdc2f4d1bb0ed8b62e6a225e3986c5f0a76e93597cedab2614ac4fdd6e18e65fc0a6ada5496770c78533fa24a2809835acaedfe8f141773f7351a28cd40266a7f47df0e616a209d52b334a46c55440000000206b296d616a9c93855b3fc75b0405ce20c3633803fcf6036aad611bcd01297c6df81fa30c25de9d6474314e0d7820293ee044b24bc8c75273a6ee62d56b1a5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1033b34065c3da01	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	taskmgr.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe
Token: SeShutdownPrivilege	1036	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2392	iexplore.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2392	iexplore.exe
2392	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2128	2392	iexplore.exe	28
PID 2392 wrote to memory of 2128	2392	iexplore.exe	28
PID 2392 wrote to memory of 2128	2392	iexplore.exe	28
PID 2392 wrote to memory of 2128	2392	iexplore.exe	28
PID 1036 wrote to memory of 1784	1036	chrome.exe	34
PID 1036 wrote to memory of 1784	1036	chrome.exe	34
PID 1036 wrote to memory of 1784	1036	chrome.exe	34
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 880	1036	chrome.exe	36
PID 1036 wrote to memory of 2452	1036	chrome.exe	37
PID 1036 wrote to memory of 2452	1036	chrome.exe	37
PID 1036 wrote to memory of 2452	1036	chrome.exe	37
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38
PID 1036 wrote to memory of 2372	1036	chrome.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\engineer-taunt.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef73f9758,0x7fef73f9768,0x7fef73f9778
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:2
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2292 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1084 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:2
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3308 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3468 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3576 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3868 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=580 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2848 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1424 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1988 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1064 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1
  2⤵
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2040 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2540 --field-trial-handle=1360,i,9143521560430487112,16204811313633611769,131072 /prefetch:1
  2⤵
  PID:2152

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1704

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2420

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2256

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\New Text Document.vbs
1⤵
PID:2772

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.bat
1⤵
PID:1692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2104
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  PID:2244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.0.1161171996\621379962" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebfa9c3f-ba36-4def-8a5d-0927f968810d} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 1300 11ec1d58 gpu
    3⤵
    PID:1676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.1.1758319658\1234398664" -parentBuildID 20221007134813 -prefsHandle 1476 -prefMapHandle 1472 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8280a7cd-8da3-4d00-9a88-c2edfc42be50} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 1488 e71958 socket
    3⤵
    PID:3052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.2.1402479694\72594014" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21031 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e674126a-7b60-4e6b-8ded-efa1a979f094} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 2108 19a86e58 tab
    3⤵
    PID:2776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.3.1359607899\1131702114" -childID 2 -isForBrowser -prefsHandle 2844 -prefMapHandle 2840 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb73632d-027e-4974-9ab3-6a41c582be69} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 2856 e68458 tab
    3⤵
    PID:1544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.4.797924293\77762396" -childID 3 -isForBrowser -prefsHandle 3000 -prefMapHandle 2992 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfb5ef7a-2893-4a34-b345-25cb51fc878c} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3012 1bc6ed58 tab
    3⤵
    PID:2844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.5.930399214\530584060" -childID 4 -isForBrowser -prefsHandle 3828 -prefMapHandle 3812 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {185925d1-bd73-4a9d-8fd2-a8c4f5fac1a9} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3836 e64458 tab
    3⤵
    PID:1960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.6.1894321466\41368387" -childID 5 -isForBrowser -prefsHandle 3960 -prefMapHandle 3964 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {00982908-f971-4907-87ea-f8e8ace5085e} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3948 1e971b58 tab
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.7.280027063\734369054" -childID 6 -isForBrowser -prefsHandle 4136 -prefMapHandle 4140 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c48de2f1-1576-419d-99f2-6e73ba4e7e64} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4124 1e972458 tab
    3⤵
    PID:2324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.8.451475193\496802201" -childID 7 -isForBrowser -prefsHandle 4492 -prefMapHandle 4480 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a2bb730-0ae8-40e4-a4c0-424ca202b090} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4504 21c7d158 tab
    3⤵
    PID:1180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.9.221849559\101998776" -childID 8 -isForBrowser -prefsHandle 2600 -prefMapHandle 2604 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac3120a9-073f-4174-a9cf-a9fe287fe9fb} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3932 17b7d458 tab
    3⤵
    PID:2144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.10.73603051\497334885" -childID 9 -isForBrowser -prefsHandle 4032 -prefMapHandle 3972 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {921c83e1-b698-4441-a80b-785df84b1791} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4252 221b4d58 tab
    3⤵
    PID:1056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.11.957811709\692858503" -childID 10 -isForBrowser -prefsHandle 4340 -prefMapHandle 8448 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db6e6953-990d-4a35-8bf2-cd04e36f5c4f} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4132 221b5358 tab
    3⤵
    PID:1880

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:3172
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2380

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:3192

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:3280

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.bat
1⤵
PID:3312

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:3424
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3452
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3460
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3468
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3476
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3484
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3492
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3500
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3504
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3520
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3524
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3536
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3540
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3556
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3576
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3560
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3572
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:764
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3584
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3592
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3600
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3608
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3616
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3624
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3628
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3640
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3648
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3656
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3668
- C:\Windows\system32\tree.com
  tree
  2⤵
  PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...