mercurialgrabber | 701f93961976def77d541a81eed72fd053b862477c64dde1c09a43d85733d85c

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	output.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	$RNBTP5J.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	$RNBTP5J.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	output.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	$RNBTP5J.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	$RNBTP5J.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	$RNBTP5J.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	$RNBTP5J.exe

Executes dropped EXE 4 IoCs

pid	Process
688	output.exe
5884	Client.exe
4104	$RNBTP5J.exe
5248	$RNBTP5J.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	$RNBTP5J.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	$RNBTP5J.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	$RNBTP5J.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	output.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	output.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	$RNBTP5J.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\output.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Client.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\$RNBTP5J.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	output.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	$RNBTP5J.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	$RNBTP5J.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	$RNBTP5J.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	$RNBTP5J.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	$RNBTP5J.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	$RNBTP5J.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	$RNBTP5J.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	output.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	$RNBTP5J.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	$RNBTP5J.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	$RNBTP5J.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	firefox.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Z_lookup_phone_number_5685021465.apk:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\output.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Client.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\$RNBTP5J.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2088	OpenWith.exe
6112	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3124	firefox.exe
Token: SeDebugPrivilege	3124	firefox.exe
Token: 33	4980	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4980	AUDIODG.EXE
Token: SeDebugPrivilege	3124	firefox.exe
Token: SeRestorePrivilege	6112	7zFM.exe
Token: 35	6112	7zFM.exe
Token: SeIncreaseQuotaPrivilege	5884	Client.exe
Token: SeSecurityPrivilege	5884	Client.exe
Token: SeTakeOwnershipPrivilege	5884	Client.exe
Token: SeLoadDriverPrivilege	5884	Client.exe
Token: SeSystemProfilePrivilege	5884	Client.exe
Token: SeSystemtimePrivilege	5884	Client.exe
Token: SeProfSingleProcessPrivilege	5884	Client.exe
Token: SeIncBasePriorityPrivilege	5884	Client.exe
Token: SeCreatePagefilePrivilege	5884	Client.exe
Token: SeBackupPrivilege	5884	Client.exe
Token: SeRestorePrivilege	5884	Client.exe
Token: SeShutdownPrivilege	5884	Client.exe
Token: SeDebugPrivilege	5884	Client.exe
Token: SeSystemEnvironmentPrivilege	5884	Client.exe
Token: SeRemoteShutdownPrivilege	5884	Client.exe
Token: SeUndockPrivilege	5884	Client.exe
Token: SeManageVolumePrivilege	5884	Client.exe
Token: SeImpersonatePrivilege	5884	Client.exe
Token: 33	5884	Client.exe
Token: 34	5884	Client.exe
Token: 35	5884	Client.exe
Token: 36	5884	Client.exe
Token: SeIncreaseQuotaPrivilege	5884	Client.exe
Token: SeSecurityPrivilege	5884	Client.exe
Token: SeTakeOwnershipPrivilege	5884	Client.exe
Token: SeLoadDriverPrivilege	5884	Client.exe
Token: SeSystemProfilePrivilege	5884	Client.exe
Token: SeSystemtimePrivilege	5884	Client.exe
Token: SeProfSingleProcessPrivilege	5884	Client.exe
Token: SeIncBasePriorityPrivilege	5884	Client.exe
Token: SeCreatePagefilePrivilege	5884	Client.exe
Token: SeBackupPrivilege	5884	Client.exe
Token: SeRestorePrivilege	5884	Client.exe
Token: SeShutdownPrivilege	5884	Client.exe
Token: SeDebugPrivilege	5884	Client.exe
Token: SeSystemEnvironmentPrivilege	5884	Client.exe
Token: SeRemoteShutdownPrivilege	5884	Client.exe
Token: SeUndockPrivilege	5884	Client.exe
Token: SeManageVolumePrivilege	5884	Client.exe
Token: SeImpersonatePrivilege	5884	Client.exe
Token: 33	5884	Client.exe
Token: 34	5884	Client.exe
Token: 35	5884	Client.exe
Token: 36	5884	Client.exe
Token: SeIncreaseQuotaPrivilege	5884	Client.exe
Token: SeSecurityPrivilege	5884	Client.exe
Token: SeTakeOwnershipPrivilege	5884	Client.exe
Token: SeLoadDriverPrivilege	5884	Client.exe
Token: SeSystemProfilePrivilege	5884	Client.exe
Token: SeSystemtimePrivilege	5884	Client.exe
Token: SeProfSingleProcessPrivilege	5884	Client.exe
Token: SeIncBasePriorityPrivilege	5884	Client.exe
Token: SeCreatePagefilePrivilege	5884	Client.exe
Token: SeBackupPrivilege	5884	Client.exe
Token: SeRestorePrivilege	5884	Client.exe
Token: SeShutdownPrivilege	5884	Client.exe
Token: SeDebugPrivilege	5884	Client.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
6112	7zFM.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe
5372	taskmgr.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
2088	OpenWith.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe
3124	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 3124	524	firefox.exe	78
PID 524 wrote to memory of 3124	524	firefox.exe	78
PID 524 wrote to memory of 3124	524	firefox.exe	78
PID 524 wrote to memory of 3124	524	firefox.exe	78
PID 524 wrote to memory of 3124	524	firefox.exe	78
PID 524 wrote to memory of 3124	524	firefox.exe	78
PID 524 wrote to memory of 3124	524	firefox.exe	78
PID 524 wrote to memory of 3124	524	firefox.exe	78
PID 524 wrote to memory of 3124	524	firefox.exe	78
PID 524 wrote to memory of 3124	524	firefox.exe	78
PID 524 wrote to memory of 3124	524	firefox.exe	78
PID 3124 wrote to memory of 4984	3124	firefox.exe	79
PID 3124 wrote to memory of 4984	3124	firefox.exe	79
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3860	3124	firefox.exe	80
PID 3124 wrote to memory of 3516	3124	firefox.exe	81
PID 3124 wrote to memory of 3516	3124	firefox.exe	81
PID 3124 wrote to memory of 3516	3124	firefox.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Z_lookup_phone_number_5685021465.apk
1⤵
- Modifies registry class
PID:3616

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1592

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:524
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.0.1515993776\210344198" -parentBuildID 20221007134813 -prefsHandle 1732 -prefMapHandle 1652 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d3869f8-3c75-4285-b81b-cbc972acf0b1} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 1812 23ddecda458 gpu
    3⤵
    PID:4984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.1.475217026\1648752814" -parentBuildID 20221007134813 -prefsHandle 2144 -prefMapHandle 2140 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e49fb93e-6fd2-466b-bc86-c1d19d25e8b3} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 2164 23dde830b58 socket
    3⤵
    PID:3860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.2.1575783600\1296886010" -childID 1 -isForBrowser -prefsHandle 2840 -prefMapHandle 2700 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13b3b838-e2ec-4fde-a150-478de08e2a54} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 2712 23de2d9c658 tab
    3⤵
    PID:3516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.3.1506249049\304656498" -childID 2 -isForBrowser -prefsHandle 3540 -prefMapHandle 3536 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1025effb-ac08-4879-a0e9-961664d72c61} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 3552 23dd3c62b58 tab
    3⤵
    PID:2808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.4.1843662055\147697230" -childID 3 -isForBrowser -prefsHandle 3712 -prefMapHandle 3772 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdf026fb-d81e-4562-831d-18cae39685a5} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 4300 23de4cfcb58 tab
    3⤵
    PID:2028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.5.824097736\397992446" -childID 4 -isForBrowser -prefsHandle 4648 -prefMapHandle 4184 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0da19ace-0e1e-4dc7-8c46-e437c87bc75e} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 4892 23de5292858 tab
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.6.1256214762\1901321711" -childID 5 -isForBrowser -prefsHandle 5028 -prefMapHandle 5032 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {907fcd6b-0de8-49e8-adcb-de45faf472f9} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 5112 23de543f858 tab
    3⤵
    PID:2076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.7.1079005335\1118328252" -childID 6 -isForBrowser -prefsHandle 5228 -prefMapHandle 5232 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5c07377-e1ad-4d22-a83e-ffef2a8b9ece} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 5220 23de5bbc258 tab
    3⤵
    PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.8.502822846\992092207" -childID 7 -isForBrowser -prefsHandle 4372 -prefMapHandle 4388 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {617c4cdd-0dd5-491f-9532-74d438210049} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 4396 23de4475e58 tab
    3⤵
    PID:3912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.9.1881244501\1176746838" -childID 8 -isForBrowser -prefsHandle 5484 -prefMapHandle 5048 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6dd2f5d9-2d1b-47e0-a1be-b79ee64ebfb1} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 4972 23de4cfce58 tab
    3⤵
    PID:4260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.10.2138843666\1341025888" -parentBuildID 20221007134813 -prefsHandle 5896 -prefMapHandle 5900 -prefsLen 26424 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5be1a3f-21a5-4f20-8e2e-c365b35b0fa6} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 5884 23de750c858 rdd
    3⤵
    PID:2640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.11.1586617237\526805999" -childID 9 -isForBrowser -prefsHandle 2744 -prefMapHandle 5020 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c19c0a8-0283-4605-88f2-ab202ca49aff} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 5496 23de7b73e58 tab
    3⤵
    PID:4424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.12.1690521034\259837041" -childID 10 -isForBrowser -prefsHandle 6088 -prefMapHandle 6084 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fedb2f8-b6f0-4ca8-9fa2-fe3da76a172b} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 6096 23dd3c63258 tab
    3⤵
    PID:2880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.13.1998873598\1104404932" -childID 11 -isForBrowser -prefsHandle 6308 -prefMapHandle 6088 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b00e212-72b8-4b3e-a74f-ac9af2317cfa} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 6320 23de617ab58 tab
    3⤵
    PID:3576
- - C:\Users\Admin\Downloads\output.exe
    "C:\Users\Admin\Downloads\output.exe"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    PID:688
- - C:\Users\Admin\Downloads\Client.exe
    "C:\Users\Admin\Downloads\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.14.705670465\1200555568" -childID 12 -isForBrowser -prefsHandle 5988 -prefMapHandle 5764 -prefsLen 27555 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {030b1131-fcd9-426a-bd7a-7fef42e61f9c} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 5500 23dd3c62558 tab
    3⤵
    PID:404
- - C:\Users\Admin\Downloads\$RNBTP5J.exe
    "C:\Users\Admin\Downloads\$RNBTP5J.exe"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    PID:4104
- - C:\Users\Admin\Downloads\$RNBTP5J.exe
    "C:\Users\Admin\Downloads\$RNBTP5J.exe"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    PID:5248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.15.1759333950\1226723467" -childID 13 -isForBrowser -prefsHandle 6312 -prefMapHandle 6416 -prefsLen 27573 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff433265-7e45-4a1e-9b6d-d170bb88fe31} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 6388 23dd3c63258 tab
    3⤵
    PID:5784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.16.1828807276\877981903" -childID 14 -isForBrowser -prefsHandle 6136 -prefMapHandle 6152 -prefsLen 27573 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2249f10-fdeb-479d-a219-ffaa9d995581} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 6184 23de3df5258 tab
    3⤵
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.17.1883637641\1719331672" -childID 15 -isForBrowser -prefsHandle 5756 -prefMapHandle 5116 -prefsLen 27573 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b090b92-aaf3-426e-adb9-b6e907100777} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 6128 23de6c35f58 tab
    3⤵
    PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3124.18.990028552\29731782" -childID 16 -isForBrowser -prefsHandle 10452 -prefMapHandle 6092 -prefsLen 27573 -prefMapSize 233444 -jsInitHandle 1112 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {efd3ee0c-61d6-4c4f-8426-0ada9d4aaa68} 3124 "\\.\pipe\gecko-crash-server-pipe.3124" 6272 23de19fa758 tab
    3⤵
    PID:5116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Z_lookup_phone_number_5685021465.apk"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6112

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion