cryptolocker | fa3544162eee87b660999bd913f76ccb2e5a706928ef2c2e29811e4ac76fb166

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Annabelle.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Annabelle.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Annabelle.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Annabelle.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MinimalX = "1"	Annabelle.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Annabelle.exe"	Annabelle.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Annabelle.exe"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Annabelle.exe"	Annabelle.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Annabelle.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\R:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\U:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\X:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\H:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\J:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\M:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\Y:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\Q:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\V:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\S:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\Z:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\B:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\T:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\W:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\K:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\L:	VirtualBox-7.0.20-163906-Win.exe
File opened (read-only)	\??\P:	VirtualBox-7.0.20-163906-Win.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpg4dmod.dll\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rasman.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydocs.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\usbui.dll	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\usbui.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cabinet.dll	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cabinet.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chkdsk.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rasman.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemexplorer.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DCIMAN32.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chkdsk.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DBGHELP.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DCIMAN32.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dllhost.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydocs.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksuser.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksuser.dll\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\url.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	Annabelle.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
275	raw.githubusercontent.com
375	raw.githubusercontent.com
272	raw.githubusercontent.com
273	raw.githubusercontent.com
274	raw.githubusercontent.com

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
3944	NetSh.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\Annabelle.exe"	Annabelle.exe

Executes dropped EXE 6 IoCs

pid	Process
3208	CryptoLocker(1).exe
3284	{34184A33-0407-212E-3320-09040709E2C2}.exe
3312	{34184A33-0407-212E-3320-09040709E2C2}.exe
2860	CryptoLocker(2).exe
2568	Annabelle.exe
316	{34184A33-0407-212E-3320-09040709E2C2}.exe

Loads dropped DLL 54 IoCs

pid	Process
2780	MsiExec.exe
2780	MsiExec.exe
2780	MsiExec.exe
2780	MsiExec.exe
2780	MsiExec.exe
2780	MsiExec.exe
3208	CryptoLocker(1).exe
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
2496	taskmgr.exe
2496	taskmgr.exe
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 7 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CryptoLocker(1).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CryptoLocker(2).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CryptoLocker(3).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CryptoLocker(4).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CryptoLocker(5).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Annabelle.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	NetSh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirtualBox-7.0.20-163906-Win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker(2).exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3928	vssadmin.exe
2456	vssadmin.exe
2968	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A2F9C670FAF5B654641E0989AD30165D480B0D4F	VirtualBox-7.0.20-163906-Win.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A2F9C670FAF5B654641E0989AD30165D480B0D4F\Blob = 030000000100000014000000a2f9c670faf5b654641e0989ad30165d480b0d4f2000000001000000430600003082063f30820427a00302010202141834630ee20ad1c97d81495caf0907822bba0071300d06092a864886f70d010105050030819a310b30090603550406130244453110300e06035504080c0742617661726961310f300d06035504070c064d756e69636831293027060355040a0c204f7261636c6520446575747363686c616e6420422e562e202620436f2e204b47313d303b06035504030c345669727475616c426f7820666f72204c65676163792057696e646f7773204f6e6c792054696d657374616d702043412053484131301e170d3130303130313030303030305a170d3337313233313233353935395a30819a310b30090603550406130244453110300e06035504080c0742617661726961310f300d06035504070c064d756e69636831293027060355040a0c204f7261636c6520446575747363686c616e6420422e562e202620436f2e204b47313d303b06035504030c345669727475616c426f7820666f72204c65676163792057696e646f7773204f6e6c792054696d657374616d70204341205348413130820222300d06092a864886f70d01010105000382020f003082020a0282020100eb2b2b32449d3ac8cd6ea98e9c3e43bd55973e96f546bedb5c770345493699ee661b27fab66c57c106d1cdc4676f6e25629cd9bd04226544c306f068e7b23a0c4dffca31a9b61cf104a11cda08648e29369f704ed3289f728b61e06c842e4edac6b798e1ca28647d3967f9dafc847d0f6ef7192c1973ea4b7b98d01bd8a82876d248e35ac69074932df4f8903d0536c3c8792ba3e7b4cfe34a231f8b06cfd78eeda189cadfcf3788198b12cbf61b90b909f86f8d2975be4795d8481356cd68be81b938f3daa6157fd4c56f0af7559e948351f23eb7edd1b21bf6b56d569db644e918b2bb8b1ca827ebaabbf34a9354dd5b844048295b44955112463eb6dee03fb94ce61e86f17056e2553d5ad743fbe20f5271851b4414a774b4234f1f5ed7f3ae7f0b01ee6dfe87a9b28ec96b1373c4c4c3bf401d0d56d60a5702213506703d6cb8a98e989023072b3a7691a3fceabc3cdb9b4edf2cb95859d0b9b6e7b70f14ee6b791b88a7bae8bde38c8dd7e4d08405c2b687984306e1758cdb4e3d7d7aba8866f5d8ccf79bcc96314473e291946ca0a37324d30d5884e5fd51f782e5b455d4d8554ac19b054e96ee2fc5846c866b6ba7fd06388fa3cf58142ec938f8c6d4cf0d375d9851eedd9c26e39f3e318145800d8f61442b6fff479eb1b9d692d82b3fc76c07bc3fdfbabcba9c7c07e419ffa373383d9ade010a96ec8fcb6731f35f0203010001a37b307930130603551d25040c300a06082b06010505070308301d0603551d0e04160414f116993ca2d97cd4756acf02af9febdfe731993e301f0603551d23041830168014f116993ca2d97cd4756acf02af9febdfe731993e30120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020106300d06092a864886f70d010105050003820201000cb7dbfa07f92940dae81f341ee5c7d5b1a5b49b3399d5f4bc4bea0ee60607eacaf9ae1bf5101b0cbf5262b08b6121fa4f6a8a823291ea8cef7f1767bfe7675d70bc6320e877c04f87021d338210930870e23ceab922b472b1abb66e8878620dfb07d3f496d66da89ac6964ae4d996f477ed586fabb590d2b190871747dcc89a8c337848a554309f363d875a8fe4c37e4a0f86350bc3f47751555af75e83c7310dbb23d17bff06900b405c794042115891400585fb60d0de9939d556f5b1ab7c998f2e79b7749b5f9a21e26c845bb5eacfd15e1238193d94e2707d6cc0e12cfc607efe4f668cd4089fdb59365961cf982479b71ff59e84e98e46b368b85d9fbf42ef151e37da25fbcfc7f187531e25499d9025c9dbca99818019af64eafbfd6990ba62c700e2119db6507fa482d3799843f971c13db473752a4647959fad6936e63386a261704137b120578384ce52f068ff00f4c2e91f395cda4fd95ae527fe01a95325b78923e18b5245e070a0c1991f010a54c7c6dbcf0b5ea2502260d1648a3aa75bfed9110011c6edf049994ba6c63525a09d2a16bed8ff04d08e196f257c7dc4ae85542299db8f238c76d6aa16a7d3e9a788bac56ec7146fb8fd443810e59a96b77f3f9eedf4e8c2187c94171eeb708c28b1565049a8509a87401f392adeabf11b148584fe35ecaff93cdbcfc9a4047c7188abf7b78b76fbefeed4c7b3	VirtualBox-7.0.20-163906-Win.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A2F9C670FAF5B654641E0989AD30165D480B0D4F\Blob = 140000000100000014000000f116993ca2d97cd4756acf02af9febdfe731993e030000000100000014000000a2f9c670faf5b654641e0989ad30165d480b0d4f0f00000001000000140000006135597bf3e5090eda793e29a604b1e4995f132d2000000001000000430600003082063f30820427a00302010202141834630ee20ad1c97d81495caf0907822bba0071300d06092a864886f70d010105050030819a310b30090603550406130244453110300e06035504080c0742617661726961310f300d06035504070c064d756e69636831293027060355040a0c204f7261636c6520446575747363686c616e6420422e562e202620436f2e204b47313d303b06035504030c345669727475616c426f7820666f72204c65676163792057696e646f7773204f6e6c792054696d657374616d702043412053484131301e170d3130303130313030303030305a170d3337313233313233353935395a30819a310b30090603550406130244453110300e06035504080c0742617661726961310f300d06035504070c064d756e69636831293027060355040a0c204f7261636c6520446575747363686c616e6420422e562e202620436f2e204b47313d303b06035504030c345669727475616c426f7820666f72204c65676163792057696e646f7773204f6e6c792054696d657374616d70204341205348413130820222300d06092a864886f70d01010105000382020f003082020a0282020100eb2b2b32449d3ac8cd6ea98e9c3e43bd55973e96f546bedb5c770345493699ee661b27fab66c57c106d1cdc4676f6e25629cd9bd04226544c306f068e7b23a0c4dffca31a9b61cf104a11cda08648e29369f704ed3289f728b61e06c842e4edac6b798e1ca28647d3967f9dafc847d0f6ef7192c1973ea4b7b98d01bd8a82876d248e35ac69074932df4f8903d0536c3c8792ba3e7b4cfe34a231f8b06cfd78eeda189cadfcf3788198b12cbf61b90b909f86f8d2975be4795d8481356cd68be81b938f3daa6157fd4c56f0af7559e948351f23eb7edd1b21bf6b56d569db644e918b2bb8b1ca827ebaabbf34a9354dd5b844048295b44955112463eb6dee03fb94ce61e86f17056e2553d5ad743fbe20f5271851b4414a774b4234f1f5ed7f3ae7f0b01ee6dfe87a9b28ec96b1373c4c4c3bf401d0d56d60a5702213506703d6cb8a98e989023072b3a7691a3fceabc3cdb9b4edf2cb95859d0b9b6e7b70f14ee6b791b88a7bae8bde38c8dd7e4d08405c2b687984306e1758cdb4e3d7d7aba8866f5d8ccf79bcc96314473e291946ca0a37324d30d5884e5fd51f782e5b455d4d8554ac19b054e96ee2fc5846c866b6ba7fd06388fa3cf58142ec938f8c6d4cf0d375d9851eedd9c26e39f3e318145800d8f61442b6fff479eb1b9d692d82b3fc76c07bc3fdfbabcba9c7c07e419ffa373383d9ade010a96ec8fcb6731f35f0203010001a37b307930130603551d25040c300a06082b06010505070308301d0603551d0e04160414f116993ca2d97cd4756acf02af9febdfe731993e301f0603551d23041830168014f116993ca2d97cd4756acf02af9febdfe731993e30120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020106300d06092a864886f70d010105050003820201000cb7dbfa07f92940dae81f341ee5c7d5b1a5b49b3399d5f4bc4bea0ee60607eacaf9ae1bf5101b0cbf5262b08b6121fa4f6a8a823291ea8cef7f1767bfe7675d70bc6320e877c04f87021d338210930870e23ceab922b472b1abb66e8878620dfb07d3f496d66da89ac6964ae4d996f477ed586fabb590d2b190871747dcc89a8c337848a554309f363d875a8fe4c37e4a0f86350bc3f47751555af75e83c7310dbb23d17bff06900b405c794042115891400585fb60d0de9939d556f5b1ab7c998f2e79b7749b5f9a21e26c845bb5eacfd15e1238193d94e2707d6cc0e12cfc607efe4f668cd4089fdb59365961cf982479b71ff59e84e98e46b368b85d9fbf42ef151e37da25fbcfc7f187531e25499d9025c9dbca99818019af64eafbfd6990ba62c700e2119db6507fa482d3799843f971c13db473752a4647959fad6936e63386a261704137b120578384ce52f068ff00f4c2e91f395cda4fd95ae527fe01a95325b78923e18b5245e070a0c1991f010a54c7c6dbcf0b5ea2502260d1648a3aa75bfed9110011c6edf049994ba6c63525a09d2a16bed8ff04d08e196f257c7dc4ae85542299db8f238c76d6aa16a7d3e9a788bac56ec7146fb8fd443810e59a96b77f3f9eedf4e8c2187c94171eeb708c28b1565049a8509a87401f392adeabf11b148584fe35ecaff93cdbcfc9a4047c7188abf7b78b76fbefeed4c7b3	VirtualBox-7.0.20-163906-Win.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A2F9C670FAF5B654641E0989AD30165D480B0D4F\Blob = 19000000010000001000000015a6a7f09e2304a29823e91ef5af979d0f00000001000000140000006135597bf3e5090eda793e29a604b1e4995f132d030000000100000014000000a2f9c670faf5b654641e0989ad30165d480b0d4f140000000100000014000000f116993ca2d97cd4756acf02af9febdfe731993e2000000001000000430600003082063f30820427a00302010202141834630ee20ad1c97d81495caf0907822bba0071300d06092a864886f70d010105050030819a310b30090603550406130244453110300e06035504080c0742617661726961310f300d06035504070c064d756e69636831293027060355040a0c204f7261636c6520446575747363686c616e6420422e562e202620436f2e204b47313d303b06035504030c345669727475616c426f7820666f72204c65676163792057696e646f7773204f6e6c792054696d657374616d702043412053484131301e170d3130303130313030303030305a170d3337313233313233353935395a30819a310b30090603550406130244453110300e06035504080c0742617661726961310f300d06035504070c064d756e69636831293027060355040a0c204f7261636c6520446575747363686c616e6420422e562e202620436f2e204b47313d303b06035504030c345669727475616c426f7820666f72204c65676163792057696e646f7773204f6e6c792054696d657374616d70204341205348413130820222300d06092a864886f70d01010105000382020f003082020a0282020100eb2b2b32449d3ac8cd6ea98e9c3e43bd55973e96f546bedb5c770345493699ee661b27fab66c57c106d1cdc4676f6e25629cd9bd04226544c306f068e7b23a0c4dffca31a9b61cf104a11cda08648e29369f704ed3289f728b61e06c842e4edac6b798e1ca28647d3967f9dafc847d0f6ef7192c1973ea4b7b98d01bd8a82876d248e35ac69074932df4f8903d0536c3c8792ba3e7b4cfe34a231f8b06cfd78eeda189cadfcf3788198b12cbf61b90b909f86f8d2975be4795d8481356cd68be81b938f3daa6157fd4c56f0af7559e948351f23eb7edd1b21bf6b56d569db644e918b2bb8b1ca827ebaabbf34a9354dd5b844048295b44955112463eb6dee03fb94ce61e86f17056e2553d5ad743fbe20f5271851b4414a774b4234f1f5ed7f3ae7f0b01ee6dfe87a9b28ec96b1373c4c4c3bf401d0d56d60a5702213506703d6cb8a98e989023072b3a7691a3fceabc3cdb9b4edf2cb95859d0b9b6e7b70f14ee6b791b88a7bae8bde38c8dd7e4d08405c2b687984306e1758cdb4e3d7d7aba8866f5d8ccf79bcc96314473e291946ca0a37324d30d5884e5fd51f782e5b455d4d8554ac19b054e96ee2fc5846c866b6ba7fd06388fa3cf58142ec938f8c6d4cf0d375d9851eedd9c26e39f3e318145800d8f61442b6fff479eb1b9d692d82b3fc76c07bc3fdfbabcba9c7c07e419ffa373383d9ade010a96ec8fcb6731f35f0203010001a37b307930130603551d25040c300a06082b06010505070308301d0603551d0e04160414f116993ca2d97cd4756acf02af9febdfe731993e301f0603551d23041830168014f116993ca2d97cd4756acf02af9febdfe731993e30120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020106300d06092a864886f70d010105050003820201000cb7dbfa07f92940dae81f341ee5c7d5b1a5b49b3399d5f4bc4bea0ee60607eacaf9ae1bf5101b0cbf5262b08b6121fa4f6a8a823291ea8cef7f1767bfe7675d70bc6320e877c04f87021d338210930870e23ceab922b472b1abb66e8878620dfb07d3f496d66da89ac6964ae4d996f477ed586fabb590d2b190871747dcc89a8c337848a554309f363d875a8fe4c37e4a0f86350bc3f47751555af75e83c7310dbb23d17bff06900b405c794042115891400585fb60d0de9939d556f5b1ab7c998f2e79b7749b5f9a21e26c845bb5eacfd15e1238193d94e2707d6cc0e12cfc607efe4f668cd4089fdb59365961cf982479b71ff59e84e98e46b368b85d9fbf42ef151e37da25fbcfc7f187531e25499d9025c9dbca99818019af64eafbfd6990ba62c700e2119db6507fa482d3799843f971c13db473752a4647959fad6936e63386a261704137b120578384ce52f068ff00f4c2e91f395cda4fd95ae527fe01a95325b78923e18b5245e070a0c1991f010a54c7c6dbcf0b5ea2502260d1648a3aa75bfed9110011c6edf049994ba6c63525a09d2a16bed8ff04d08e196f257c7dc4ae85542299db8f238c76d6aa16a7d3e9a788bac56ec7146fb8fd443810e59a96b77f3f9eedf4e8c2187c94171eeb708c28b1565049a8509a87401f392adeabf11b148584fe35ecaff93cdbcfc9a4047c7188abf7b78b76fbefeed4c7b3	VirtualBox-7.0.20-163906-Win.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	VirtualBox-7.0.20-163906-Win.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	VirtualBox-7.0.20-163906-Win.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	VirtualBox-7.0.20-163906-Win.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A2F9C670FAF5B654641E0989AD30165D480B0D4F\Blob = 0f00000001000000140000006135597bf3e5090eda793e29a604b1e4995f132d030000000100000014000000a2f9c670faf5b654641e0989ad30165d480b0d4f2000000001000000430600003082063f30820427a00302010202141834630ee20ad1c97d81495caf0907822bba0071300d06092a864886f70d010105050030819a310b30090603550406130244453110300e06035504080c0742617661726961310f300d06035504070c064d756e69636831293027060355040a0c204f7261636c6520446575747363686c616e6420422e562e202620436f2e204b47313d303b06035504030c345669727475616c426f7820666f72204c65676163792057696e646f7773204f6e6c792054696d657374616d702043412053484131301e170d3130303130313030303030305a170d3337313233313233353935395a30819a310b30090603550406130244453110300e06035504080c0742617661726961310f300d06035504070c064d756e69636831293027060355040a0c204f7261636c6520446575747363686c616e6420422e562e202620436f2e204b47313d303b06035504030c345669727475616c426f7820666f72204c65676163792057696e646f7773204f6e6c792054696d657374616d70204341205348413130820222300d06092a864886f70d01010105000382020f003082020a0282020100eb2b2b32449d3ac8cd6ea98e9c3e43bd55973e96f546bedb5c770345493699ee661b27fab66c57c106d1cdc4676f6e25629cd9bd04226544c306f068e7b23a0c4dffca31a9b61cf104a11cda08648e29369f704ed3289f728b61e06c842e4edac6b798e1ca28647d3967f9dafc847d0f6ef7192c1973ea4b7b98d01bd8a82876d248e35ac69074932df4f8903d0536c3c8792ba3e7b4cfe34a231f8b06cfd78eeda189cadfcf3788198b12cbf61b90b909f86f8d2975be4795d8481356cd68be81b938f3daa6157fd4c56f0af7559e948351f23eb7edd1b21bf6b56d569db644e918b2bb8b1ca827ebaabbf34a9354dd5b844048295b44955112463eb6dee03fb94ce61e86f17056e2553d5ad743fbe20f5271851b4414a774b4234f1f5ed7f3ae7f0b01ee6dfe87a9b28ec96b1373c4c4c3bf401d0d56d60a5702213506703d6cb8a98e989023072b3a7691a3fceabc3cdb9b4edf2cb95859d0b9b6e7b70f14ee6b791b88a7bae8bde38c8dd7e4d08405c2b687984306e1758cdb4e3d7d7aba8866f5d8ccf79bcc96314473e291946ca0a37324d30d5884e5fd51f782e5b455d4d8554ac19b054e96ee2fc5846c866b6ba7fd06388fa3cf58142ec938f8c6d4cf0d375d9851eedd9c26e39f3e318145800d8f61442b6fff479eb1b9d692d82b3fc76c07bc3fdfbabcba9c7c07e419ffa373383d9ade010a96ec8fcb6731f35f0203010001a37b307930130603551d25040c300a06082b06010505070308301d0603551d0e04160414f116993ca2d97cd4756acf02af9febdfe731993e301f0603551d23041830168014f116993ca2d97cd4756acf02af9febdfe731993e30120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020106300d06092a864886f70d010105050003820201000cb7dbfa07f92940dae81f341ee5c7d5b1a5b49b3399d5f4bc4bea0ee60607eacaf9ae1bf5101b0cbf5262b08b6121fa4f6a8a823291ea8cef7f1767bfe7675d70bc6320e877c04f87021d338210930870e23ceab922b472b1abb66e8878620dfb07d3f496d66da89ac6964ae4d996f477ed586fabb590d2b190871747dcc89a8c337848a554309f363d875a8fe4c37e4a0f86350bc3f47751555af75e83c7310dbb23d17bff06900b405c794042115891400585fb60d0de9939d556f5b1ab7c998f2e79b7749b5f9a21e26c845bb5eacfd15e1238193d94e2707d6cc0e12cfc607efe4f668cd4089fdb59365961cf982479b71ff59e84e98e46b368b85d9fbf42ef151e37da25fbcfc7f187531e25499d9025c9dbca99818019af64eafbfd6990ba62c700e2119db6507fa482d3799843f971c13db473752a4647959fad6936e63386a261704137b120578384ce52f068ff00f4c2e91f395cda4fd95ae527fe01a95325b78923e18b5245e070a0c1991f010a54c7c6dbcf0b5ea2502260d1648a3aa75bfed9110011c6edf049994ba6c63525a09d2a16bed8ff04d08e196f257c7dc4ae85542299db8f238c76d6aa16a7d3e9a788bac56ec7146fb8fd443810e59a96b77f3f9eedf4e8c2187c94171eeb708c28b1565049a8509a87401f392adeabf11b148584fe35ecaff93cdbcfc9a4047c7188abf7b78b76fbefeed4c7b3	VirtualBox-7.0.20-163906-Win.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	VirtualBox-7.0.20-163906-Win.exe

NTFS ADS 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CryptoLocker(1).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CryptoLocker(2).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CryptoLocker(3).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CryptoLocker(4).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CryptoLocker(5).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:Zone.Identifier:$DATA	CryptoLocker(1).exe
File created	C:\Users\Admin\Downloads\Annabelle.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2240	chrome.exe
2240	chrome.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2496	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeIncreaseQuotaPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeSecurityPrivilege	1676	msiexec.exe
Token: SeCreateTokenPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeAssignPrimaryTokenPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeLockMemoryPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeIncreaseQuotaPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeMachineAccountPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeTcbPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeSecurityPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeTakeOwnershipPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeLoadDriverPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeSystemProfilePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeSystemtimePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeProfSingleProcessPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeIncBasePriorityPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeCreatePagefilePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeCreatePermanentPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeBackupPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeRestorePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeShutdownPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeDebugPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeAuditPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeSystemEnvironmentPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeChangeNotifyPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeRemoteShutdownPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeUndockPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeSyncAgentPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeEnableDelegationPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeManageVolumePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeImpersonatePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeCreateGlobalPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeCreateTokenPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeAssignPrimaryTokenPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeLockMemoryPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeIncreaseQuotaPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeMachineAccountPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeTcbPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeSecurityPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeTakeOwnershipPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeLoadDriverPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeSystemProfilePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeSystemtimePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeProfSingleProcessPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeIncBasePriorityPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeCreatePagefilePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeCreatePermanentPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeBackupPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeRestorePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeShutdownPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeDebugPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeAuditPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeSystemEnvironmentPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeChangeNotifyPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeRemoteShutdownPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeUndockPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeSyncAgentPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeEnableDelegationPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeManageVolumePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeImpersonatePrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeCreateGlobalPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe
Token: SeCreateTokenPrivilege	3024	VirtualBox-7.0.20-163906-Win.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3024	VirtualBox-7.0.20-163906-Win.exe
3024	VirtualBox-7.0.20-163906-Win.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2372	firefox.exe
2372	firefox.exe
2372	firefox.exe
2372	firefox.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2240	chrome.exe
2372	firefox.exe
2372	firefox.exe
2372	firefox.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2372	firefox.exe
2372	firefox.exe
2372	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2780	1676	msiexec.exe	32
PID 1676 wrote to memory of 2780	1676	msiexec.exe	32
PID 1676 wrote to memory of 2780	1676	msiexec.exe	32
PID 1676 wrote to memory of 2780	1676	msiexec.exe	32
PID 1676 wrote to memory of 2780	1676	msiexec.exe	32
PID 2240 wrote to memory of 856	2240	chrome.exe	34
PID 2240 wrote to memory of 856	2240	chrome.exe	34
PID 2240 wrote to memory of 856	2240	chrome.exe	34
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1612	2240	chrome.exe	36
PID 2240 wrote to memory of 1616	2240	chrome.exe	37
PID 2240 wrote to memory of 1616	2240	chrome.exe	37
PID 2240 wrote to memory of 1616	2240	chrome.exe	37
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38
PID 2240 wrote to memory of 1572	2240	chrome.exe	38

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	Annabelle.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1"	Annabelle.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	Annabelle.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.0.20-163906-Win.exe
"C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.0.20-163906-Win.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3024

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 7DFC96B69F0076DCA1BA595EFC461252 C
  2⤵
  - Loads dropped DLL
  PID:2780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7359758,0x7fef7359768,0x7fef7359778
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1252,i,12864134524606713587,15578219824181697808,131072 /prefetch:2
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1252,i,12864134524606713587,15578219824181697808,131072 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1252,i,12864134524606713587,15578219824181697808,131072 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1252,i,12864134524606713587,15578219824181697808,131072 /prefetch:1
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1252,i,12864134524606713587,15578219824181697808,131072 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1444 --field-trial-handle=1252,i,12864134524606713587,15578219824181697808,131072 /prefetch:2
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1480 --field-trial-handle=1252,i,12864134524606713587,15578219824181697808,131072 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 --field-trial-handle=1252,i,12864134524606713587,15578219824181697808,131072 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3664 --field-trial-handle=1252,i,12864134524606713587,15578219824181697808,131072 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2344 --field-trial-handle=1252,i,12864134524606713587,15578219824181697808,131072 /prefetch:1
  2⤵
  PID:184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2688 --field-trial-handle=1252,i,12864134524606713587,15578219824181697808,131072 /prefetch:1
  2⤵
  PID:960

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:748

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1160
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.0.571112212\1930694157" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1136 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a90fe9a2-c152-4dea-aab0-caefe3138fed} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 1336 42f8758 gpu
    3⤵
    PID:2852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.1.127941800\1491207635" -parentBuildID 20221007134813 -prefsHandle 1472 -prefMapHandle 1468 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0488eed8-251e-46fd-81e1-3d40fb8ddcf9} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 1484 42c5858 socket
    3⤵
    PID:640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.2.1847693107\1324219684" -childID 1 -isForBrowser -prefsHandle 1940 -prefMapHandle 1936 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef2b3839-3e18-430b-bbce-3cfa2b5760ad} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 1908 19e70858 tab
    3⤵
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.3.1888021225\2097654990" -childID 2 -isForBrowser -prefsHandle 2676 -prefMapHandle 2672 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d166b8b7-db4d-4086-b839-1a849b900ed7} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 2696 1c199958 tab
    3⤵
    PID:2768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.4.226610400\762084257" -childID 3 -isForBrowser -prefsHandle 3000 -prefMapHandle 2996 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87c041e6-1a41-4d4b-9466-3a23c8c690e6} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 3012 1c199358 tab
    3⤵
    PID:2020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.5.585625771\1061615551" -childID 4 -isForBrowser -prefsHandle 3844 -prefMapHandle 3836 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {839b0cf1-d9b9-44b1-9f2d-d22321b398c1} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 3860 1f316258 tab
    3⤵
    PID:3056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.6.1264330084\1480671412" -childID 5 -isForBrowser -prefsHandle 3988 -prefMapHandle 3992 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97d37b60-d502-45cc-aa9f-dc09dede04c9} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 3976 1f316858 tab
    3⤵
    PID:448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.7.772170438\1762673039" -childID 6 -isForBrowser -prefsHandle 4160 -prefMapHandle 4164 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39479625-f1d7-42a6-809c-b136dc64505d} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 4148 1eca2858 tab
    3⤵
    PID:1776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.8.1073587657\2007261612" -childID 7 -isForBrowser -prefsHandle 3592 -prefMapHandle 3620 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {242a0c5f-94eb-434d-ab02-c417aa70bec6} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 4460 d2e458 tab
    3⤵
    PID:2964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.9.920183507\471740007" -childID 8 -isForBrowser -prefsHandle 3940 -prefMapHandle 3948 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fe17293-ba8d-4a17-a00b-51f111137d3c} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 3920 d62858 tab
    3⤵
    PID:2600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.10.1741378283\622926925" -childID 9 -isForBrowser -prefsHandle 4140 -prefMapHandle 3272 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f2d92f3-2ab5-47dd-8602-f444c97bbc7b} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 4296 1a5fdb58 tab
    3⤵
    PID:2936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.11.1391814648\1966903247" -childID 10 -isForBrowser -prefsHandle 4344 -prefMapHandle 4340 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f286c599-e3d6-4131-81e1-f5b7269abc33} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 3848 1b0c1e58 tab
    3⤵
    PID:1012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.12.1569105600\221949218" -childID 11 -isForBrowser -prefsHandle 3416 -prefMapHandle 1784 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b935920-a5df-42e1-a4fa-4020186c3aa8} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 3624 d2f358 tab
    3⤵
    PID:2504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2372.13.2096539786\198863630" -childID 12 -isForBrowser -prefsHandle 4488 -prefMapHandle 8180 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 628 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {988f9cba-b7a6-400f-823a-0599b445407a} 2372 "\\.\pipe\gecko-crash-server-pipe.2372" 4344 1be23458 tab
    3⤵
    PID:1208

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3460

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x180
1⤵
PID:3844

C:\Users\Admin\Downloads\CryptoLocker(1).exe
"C:\Users\Admin\Downloads\CryptoLocker(1).exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:3208
- C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
  "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker(1).exe"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3284
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000000C8
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3312
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000000C8
    3⤵
    - Executes dropped EXE
    PID:316

C:\Users\Admin\Downloads\CryptoLocker(2).exe
"C:\Users\Admin\Downloads\CryptoLocker(2).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2496

C:\Users\Admin\Downloads\Annabelle.exe
"C:\Users\Admin\Downloads\Annabelle.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Event Triggered Execution: Image File Execution Options Injection
- Modifies WinLogon for persistence
- Executes dropped EXE
- System policy modification
PID:2568
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3928
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2456
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2968
- C:\Windows\system32\NetSh.exe
  NetSh Advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3944
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" -r -t 00 -f
  2⤵
  PID:3848

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2736

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:3888

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery