xenarmor | ba599c53479ad87732d7d5dab8a4cca44bb55cbc134e6054ddb6414e9cfd1508

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3816	powershell.exe
256	powershell.exe
1336	powershell.exe
2316	powershell.exe

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6116	netsh.exe

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000900000001aba5-785.dat	acprotect
behavioral1/files/0x0003000000019579-780.dat	acprotect
behavioral1/files/0x0003000000019578-775.dat	acprotect
behavioral1/files/0x000c000000018f5c-770.dat	acprotect
behavioral1/files/0x000d000000018f58-765.dat	acprotect

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\St.lnk	X.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\St.lnk	X.exe

Executes dropped EXE 20 IoCs

pid	Process
2968	St.exe
5192	St.exe
6068	St.exe
2740	St.exe
5096	St.exe
1808	St.exe
912	St.exe
3440	St.exe
5816	St.exe
2172	St.exe
704	rpuojl.exe
6064	rpuojl.tmp
4524	St.exe
1336	St.exe
3544	All-In-One.exe
1624	St.exe
5072	St.exe
5736	St.exe
4148	St.exe
6828	St.exe

Loads dropped DLL 6 IoCs

pid	Process
4212	MsiExec.exe
3672	MsiExec.exe
3672	MsiExec.exe
4212	MsiExec.exe
1424	X.exe
3544	All-In-One.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000900000001aba5-785.dat	upx
behavioral1/files/0x0003000000019579-780.dat	upx
behavioral1/files/0x0003000000019578-775.dat	upx
behavioral1/files/0x000c000000018f5c-770.dat	upx
behavioral1/files/0x000d000000018f58-765.dat	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	All-In-One.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\St = "C:\\Users\\Admin\\AppData\\Local\\Temp\\St.exe"	X.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	fsquirt.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	MsiExec.exe
File opened (read-only)	\??\Z:	MsiExec.exe
File opened (read-only)	\??\Z:	MsiExec.exe
File opened (read-only)	\??\T:	MsiExec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	MsiExec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	MsiExec.exe
File opened (read-only)	\??\K:	MsiExec.exe
File opened (read-only)	\??\B:	MsiExec.exe
File opened (read-only)	\??\O:	MsiExec.exe
File opened (read-only)	\??\R:	MsiExec.exe
File opened (read-only)	\??\X:	MsiExec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	MsiExec.exe
File opened (read-only)	\??\I:	MsiExec.exe
File opened (read-only)	\??\Q:	MsiExec.exe
File opened (read-only)	\??\W:	MsiExec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	MsiExec.exe
File opened (read-only)	\??\Q:	MsiExec.exe
File opened (read-only)	\??\A:	MsiExec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	MsiExec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	MsiExec.exe
File opened (read-only)	\??\M:	MsiExec.exe
File opened (read-only)	\??\N:	MsiExec.exe
File opened (read-only)	\??\P:	MsiExec.exe
File opened (read-only)	\??\W:	MsiExec.exe
File opened (read-only)	\??\Y:	MsiExec.exe
File opened (read-only)	\??\H:	MsiExec.exe
File opened (read-only)	\??\O:	MsiExec.exe
File opened (read-only)	\??\M:	MsiExec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	MsiExec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\K:	MsiExec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	MsiExec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	MsiExec.exe
File opened (read-only)	\??\T:	MsiExec.exe
File opened (read-only)	\??\E:	MsiExec.exe
File opened (read-only)	\??\P:	MsiExec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	MsiExec.exe
File opened (read-only)	\??\R:	MsiExec.exe
File opened (read-only)	\??\G:	MsiExec.exe
File opened (read-only)	\??\X:	MsiExec.exe
File opened (read-only)	\??\S:	MsiExec.exe
File opened (read-only)	\??\L:	MsiExec.exe
File opened (read-only)	\??\S:	MsiExec.exe
File opened (read-only)	\??\U:	MsiExec.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
78	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	X.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	explorer.exe
File created	C:\Windows\rescache\_merged\4032412167\4002656488.pri	explorer.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	explorer.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 29 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsiExec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MsiExec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsiExec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	X.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4724	taskkill.exe

Modifies Control Panel 64 IoCs

evasion

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\Blind Access	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\TimeOut	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\WindowMetrics	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Bluetooth	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Infrared	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Sound	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Appearance\Schemes	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys\00000071	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys\00000104	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys\00000200	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\PowerCfg\PowerPolicies\2	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\ShowSounds	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Bluetooth\FileSquirtInstalled	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys\00000070	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys\00000203	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\Keyboard Response	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys\00000011	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\On	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\PowerCfg\PowerPolicies\3	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\PowerCfg	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\StickyKeys	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\ToggleKeys	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys\00000012	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\PowerCfg\PowerPolicies\4	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Quick Actions\Pinned	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\User Profile\en-US	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Personalization\Desktop Slideshow	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Cursors	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys\00000010	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\🌎🌏	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Quick Actions	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Appearance	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\User Profile	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Personalization	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\PowerCfg\GlobalPowerPolicy	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\PowerCfg\PowerPolicies\1	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\PowerCfg\PowerPolicies\5	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\MouseKeys	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\User Profile System Backup\en-US	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\User Profile System Backup	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Infrared\File Transfer	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\PowerCfg\PowerPolicies	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\HighContrast	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Appearance\New Schemes	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Colors	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Infrared\IrTranP	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\SlateLaunch	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys\00000202	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Keyboard	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Mouse	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\PowerCfg\PowerPolicies\0	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\AudioDescription	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\SoundSentry	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Infrared\Global	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys\00000072	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Input Method\Hot Keys\00000201	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Accessibility\Keyboard Preference	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\Colors	X.exe
Key deleted	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\Desktop\LanguageConfiguration	X.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\International\AcceptLanguage = "en-US,en;q=0.5"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\Navigating	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\PanelSound	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Call9	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\WindowsUAC	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\.Default\.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\MailBeep	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Minimize\.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call4\.Current	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Mail\.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Call4	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Call	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\FaxBeep\.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call10\.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\HubOffSound	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceConnect	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm5\.Current	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call9\.Current	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Proximity	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\.default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\.default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\International\User Profile\en-US	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\ChangeTheme\.Current	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\Quick Actions	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Alarm4	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Maximize	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call4	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemNotification\.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\SecurityBand\.default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\HubOnSound	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\CCSelect	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\ChangeTheme	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\RestoreUp\.Current	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Environment	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\AppGPFault	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Call7	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\SystemExclamation	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm7\.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call5\.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\PrintComplete	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsUnlock\.Current	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\EUDC\932	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\DisNumbersSound	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.IM	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call8	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\MailBeep	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\AppGPFault\.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm4	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\RestoreUp	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemExclamation	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\BlockedPopup	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\Accessibility\Blind Access	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\Accessibility\HighContrast	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Alarm2	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\PowerCfg\PowerPolicies\4	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\MailBeep\.Current	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm4\.Current	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call6	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Mail	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\ChangeTheme\.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\SecurityBand	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceFail\.Current	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemQuestion\.Default	X.exe
Key deleted	\REGISTRY\USER\S-1-5-19\EUDC\950	X.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d3436a6b00ddda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567065551368052"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f80cb859f6720028040b29b5540cc05aab60000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "690"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4148	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4584	explorer.exe
4556	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3816	powershell.exe
3816	powershell.exe
3816	powershell.exe
256	powershell.exe
256	powershell.exe
256	powershell.exe
1336	powershell.exe
1336	powershell.exe
1336	powershell.exe
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4584	explorer.exe
4872	taskmgr.exe
4556	explorer.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3900	MicrosoftEdgeCP.exe
3900	MicrosoftEdgeCP.exe
3900	MicrosoftEdgeCP.exe
3900	MicrosoftEdgeCP.exe
3900	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe
4600	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1424	X.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeIncreaseQuotaPrivilege	3816	powershell.exe
Token: SeSecurityPrivilege	3816	powershell.exe
Token: SeTakeOwnershipPrivilege	3816	powershell.exe
Token: SeLoadDriverPrivilege	3816	powershell.exe
Token: SeSystemProfilePrivilege	3816	powershell.exe
Token: SeSystemtimePrivilege	3816	powershell.exe
Token: SeProfSingleProcessPrivilege	3816	powershell.exe
Token: SeIncBasePriorityPrivilege	3816	powershell.exe
Token: SeCreatePagefilePrivilege	3816	powershell.exe
Token: SeBackupPrivilege	3816	powershell.exe
Token: SeRestorePrivilege	3816	powershell.exe
Token: SeShutdownPrivilege	3816	powershell.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeSystemEnvironmentPrivilege	3816	powershell.exe
Token: SeRemoteShutdownPrivilege	3816	powershell.exe
Token: SeUndockPrivilege	3816	powershell.exe
Token: SeManageVolumePrivilege	3816	powershell.exe
Token: 33	3816	powershell.exe
Token: 34	3816	powershell.exe
Token: 35	3816	powershell.exe
Token: 36	3816	powershell.exe
Token: SeDebugPrivilege	256	powershell.exe
Token: SeIncreaseQuotaPrivilege	256	powershell.exe
Token: SeSecurityPrivilege	256	powershell.exe
Token: SeTakeOwnershipPrivilege	256	powershell.exe
Token: SeLoadDriverPrivilege	256	powershell.exe
Token: SeSystemProfilePrivilege	256	powershell.exe
Token: SeSystemtimePrivilege	256	powershell.exe
Token: SeProfSingleProcessPrivilege	256	powershell.exe
Token: SeIncBasePriorityPrivilege	256	powershell.exe
Token: SeCreatePagefilePrivilege	256	powershell.exe
Token: SeBackupPrivilege	256	powershell.exe
Token: SeRestorePrivilege	256	powershell.exe
Token: SeShutdownPrivilege	256	powershell.exe
Token: SeDebugPrivilege	256	powershell.exe
Token: SeSystemEnvironmentPrivilege	256	powershell.exe
Token: SeRemoteShutdownPrivilege	256	powershell.exe
Token: SeUndockPrivilege	256	powershell.exe
Token: SeManageVolumePrivilege	256	powershell.exe
Token: 33	256	powershell.exe
Token: 34	256	powershell.exe
Token: 35	256	powershell.exe
Token: 36	256	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeIncreaseQuotaPrivilege	1336	powershell.exe
Token: SeSecurityPrivilege	1336	powershell.exe
Token: SeTakeOwnershipPrivilege	1336	powershell.exe
Token: SeLoadDriverPrivilege	1336	powershell.exe
Token: SeSystemProfilePrivilege	1336	powershell.exe
Token: SeSystemtimePrivilege	1336	powershell.exe
Token: SeProfSingleProcessPrivilege	1336	powershell.exe
Token: SeIncBasePriorityPrivilege	1336	powershell.exe
Token: SeCreatePagefilePrivilege	1336	powershell.exe
Token: SeBackupPrivilege	1336	powershell.exe
Token: SeRestorePrivilege	1336	powershell.exe
Token: SeShutdownPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeSystemEnvironmentPrivilege	1336	powershell.exe
Token: SeRemoteShutdownPrivilege	1336	powershell.exe
Token: SeUndockPrivilege	1336	powershell.exe
Token: SeManageVolumePrivilege	1336	powershell.exe
Token: 33	1336	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe
4872	taskmgr.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
4584	explorer.exe
4584	explorer.exe
3544	All-In-One.exe
3544	All-In-One.exe
2236	SearchUI.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
4556	explorer.exe
6072	MicrosoftEdge.exe
3900	MicrosoftEdgeCP.exe
5456	MicrosoftEdgeCP.exe
3900	MicrosoftEdgeCP.exe
508	MicrosoftEdgeCP.exe
3868	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 3816	1424	X.exe	74
PID 1424 wrote to memory of 3816	1424	X.exe	74
PID 1424 wrote to memory of 256	1424	X.exe	77
PID 1424 wrote to memory of 256	1424	X.exe	77
PID 1424 wrote to memory of 1336	1424	X.exe	79
PID 1424 wrote to memory of 1336	1424	X.exe	79
PID 1424 wrote to memory of 2316	1424	X.exe	81
PID 1424 wrote to memory of 2316	1424	X.exe	81
PID 1424 wrote to memory of 4148	1424	X.exe	83
PID 1424 wrote to memory of 4148	1424	X.exe	83
PID 1424 wrote to memory of 4336	1424	X.exe	88
PID 1424 wrote to memory of 4336	1424	X.exe	88
PID 4336 wrote to memory of 2336	4336	powershell.exe	91
PID 4336 wrote to memory of 2336	4336	powershell.exe	91
PID 1424 wrote to memory of 4600	1424	X.exe	94
PID 1424 wrote to memory of 4600	1424	X.exe	94
PID 4600 wrote to memory of 2884	4600	chrome.exe	95
PID 4600 wrote to memory of 2884	4600	chrome.exe	95
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 3936	4600	chrome.exe	96
PID 4600 wrote to memory of 948	4600	chrome.exe	97
PID 4600 wrote to memory of 948	4600	chrome.exe	97
PID 4600 wrote to memory of 2020	4600	chrome.exe	98
PID 4600 wrote to memory of 2020	4600	chrome.exe	98
PID 4600 wrote to memory of 2020	4600	chrome.exe	98
PID 4600 wrote to memory of 2020	4600	chrome.exe	98
PID 4600 wrote to memory of 2020	4600	chrome.exe	98
PID 4600 wrote to memory of 2020	4600	chrome.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\X.exe
"C:\Users\Admin\AppData\Local\Temp\X.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\X.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'X.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\St.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'St.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "St" /tr "C:\Users\Admin\AppData\Local\Temp\St.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text
    3⤵
    PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --mute-audio --disable-audio --disable-3d-apis --disable-gpu --disable-d3d11 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff8c49b9758,0x7ff8c49b9768,0x7ff8c49b9778
    3⤵
    PID:2884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1612 --field-trial-handle=1988,i,2183944391970623976,6611169500518230388,131072 /prefetch:2
    3⤵
    PID:3936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --mojo-platform-channel-handle=1732 --field-trial-handle=1988,i,2183944391970623976,6611169500518230388,131072 /prefetch:8
    3⤵
    PID:948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --mojo-platform-channel-handle=1824 --field-trial-handle=1988,i,2183944391970623976,6611169500518230388,131072 /prefetch:8
    3⤵
    PID:2020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --disable-3d-apis --display-capture-permissions-policy-allowed --first-renderer-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1988,i,2183944391970623976,6611169500518230388,131072 /prefetch:1
    3⤵
    PID:2812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --disable-3d-apis --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1988,i,2183944391970623976,6611169500518230388,131072 /prefetch:1
    3⤵
    PID:164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --disable-3d-apis --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3800 --field-trial-handle=1988,i,2183944391970623976,6611169500518230388,131072 /prefetch:1
    3⤵
    PID:208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --mojo-platform-channel-handle=4784 --field-trial-handle=1988,i,2183944391970623976,6611169500518230388,131072 /prefetch:8
    3⤵
    PID:3540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --mojo-platform-channel-handle=4904 --field-trial-handle=1988,i,2183944391970623976,6611169500518230388,131072 /prefetch:8
    3⤵
    PID:3820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --mojo-platform-channel-handle=4940 --field-trial-handle=1988,i,2183944391970623976,6611169500518230388,131072 /prefetch:8
    3⤵
    PID:4848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --disable-3d-apis --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4560 --field-trial-handle=1988,i,2183944391970623976,6611169500518230388,131072 /prefetch:1
    3⤵
    PID:4240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Chrome Data" --disable-3d-apis --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3984 --field-trial-handle=1988,i,2183944391970623976,6611169500518230388,131072 /prefetch:1
    3⤵
    PID:4456
- C:\Windows\SYSTEM32\MsiExec.exe
  MsiExec.exe /I{64A3A4F4-B792-11D6-A78A-00B0D0180381}
  2⤵
  - Enumerates connected drives
  - Checks processor information in registry
  PID:5020
- C:\Windows\SYSTEM32\MsiExec.exe
  MsiExec.exe /I{64A3A4F4-B792-11D6-A78A-00B0D0180381}
  2⤵
  - Enumerates connected drives
  - Checks processor information in registry
  PID:3540
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6116
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\il2ia52p\il2ia52p.cmdline"
  2⤵
  PID:1508
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF39.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2272BBF7DEE44CF1AC996576C374D758.TMP"
    3⤵
    PID:5344
- C:\Users\Admin\AppData\Local\Temp\rpuojl.exe
  "C:\Users\Admin\AppData\Local\Temp\rpuojl.exe"
  2⤵
  - Executes dropped EXE
  PID:704
- - C:\Users\Admin\AppData\Local\Temp\is-SU77T.tmp\rpuojl.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-SU77T.tmp\rpuojl.tmp" /SL5="$8026A,1848191,161792,C:\Users\Admin\AppData\Local\Temp\rpuojl.exe"
    3⤵
    - Executes dropped EXE
    PID:6064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json
  2⤵
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
    All-In-One.exe OutPut.json
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Accesses Microsoft Outlook accounts
    - Suspicious use of SetWindowsHookEx
    PID:3544
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4724
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4556
- - C:\Windows\System32\fsquirt.exe
    "C:\Windows\System32\fsquirt.exe" -Register
    3⤵
    - Drops desktop.ini file(s)
    PID:3080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:3716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:3868
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.0.854871426\1626394262" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1740 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {133ca26d-c8f3-4758-9685-cc22d7b3b7d6} 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 1828 1fa2c5f9458 gpu
        5⤵
        
        PID:4400
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.1.129685864\1995313430" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5dc94a02-6e03-44d7-ae98-41b5f9d4ab1e} 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 2184 1fa21572858 socket
        5⤵
        Checks processor information in registry
        
        PID:3676
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.2.1867473384\82741686" -childID 1 -isForBrowser -prefsHandle 2908 -prefMapHandle 2716 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7fc48c4-f4e9-40f7-9175-e1904a634e50} 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 2728 1fa2c55e458 tab
        5⤵
        
        PID:5644
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.3.1434362396\2128268568" -childID 2 -isForBrowser -prefsHandle 3432 -prefMapHandle 3428 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d78ad1f1-2a4e-4b19-9cd2-adcf544d9b33} 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 3448 1fa31605058 tab
        5⤵
        
        PID:4008
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.4.1511221677\284525651" -childID 3 -isForBrowser -prefsHandle 4224 -prefMapHandle 4220 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79a861e2-72e0-4ef9-b9bc-a8c7fe53b224} 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 4248 1fa325d1958 tab
        5⤵
        
        PID:3708
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.5.684513553\515386843" -childID 4 -isForBrowser -prefsHandle 4760 -prefMapHandle 4756 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2898c776-95f8-4e61-a087-fb758773601c} 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 4744 1fa30ddc458 tab
        5⤵
        
        PID:3552
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.6.1503981897\1095432701" -childID 5 -isForBrowser -prefsHandle 4824 -prefMapHandle 4828 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2669a3dd-482b-47f6-ae1a-71ca90992d5d} 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 4908 1fa32e1cc58 tab
        5⤵
        
        PID:3880
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.7.602788434\2025800455" -childID 6 -isForBrowser -prefsHandle 5052 -prefMapHandle 5056 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c16fbb0-2196-4c4d-9afc-6ef63a751a27} 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 4724 1fa333d0358 tab
        5⤵
        
        PID:5012
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3868.8.456499091\1963057900" -childID 7 -isForBrowser -prefsHandle 5540 -prefMapHandle 5536 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07bd22ac-900b-4be9-b1d5-6fef8f29a988} 3868 "\\.\pipe\gecko-crash-server-pipe.3868" 5624 1fa30880858 tab
        5⤵
        
        PID:6720

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4872

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:2968

C:\Windows\system32\ctfmon.exe
ctfmon.exe
1⤵
PID:2532

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
1⤵
PID:2456

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4528

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:5192

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:6068

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:2740

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
PID:6008
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 77429A50F0DBDB2929D7E15ABC763C93 C
  2⤵
  - Loads dropped DLL
  PID:4212
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DBE2C2B20AC050331353144DAE55F592 C
  2⤵
  - Loads dropped DLL
  PID:3672

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:4632

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:1808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x414
1⤵
PID:5000

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:912

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:3440

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:5816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3852

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:2172

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:4524

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:1336

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -s CryptSvc
1⤵
PID:5940

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2236

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:5072

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:5736

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:4148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6072

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4588

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5456

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:5544

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:508

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1388

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5908

C:\Users\Admin\AppData\Local\Temp\St.exe
C:\Users\Admin\AppData\Local\Temp\St.exe
1⤵
- Executes dropped EXE
PID:6828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery