toxiceye | 7485b221926010f27cda7f15f35a5c465558eb8c20b4fc37053850ed2b4a211a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	rat.exe

Executes dropped EXE 1 IoCs

pid	Process
2144	rat.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2180	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4764	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
848	schtasks.exe
2468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe
2144	rat.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4428	TelegramRAT.exe
Token: SeDebugPrivilege	2180	tasklist.exe
Token: SeDebugPrivilege	2144	rat.exe
Token: SeDebugPrivilege	2144	rat.exe
Token: SeDebugPrivilege	2156	firefox.exe
Token: SeDebugPrivilege	2156	firefox.exe
Token: SeDebugPrivilege	2156	firefox.exe
Token: SeDebugPrivilege	2156	firefox.exe
Token: SeDebugPrivilege	2156	firefox.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2144	rat.exe
2156	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 848	4428	TelegramRAT.exe	92
PID 4428 wrote to memory of 848	4428	TelegramRAT.exe	92
PID 4428 wrote to memory of 816	4428	TelegramRAT.exe	95
PID 4428 wrote to memory of 816	4428	TelegramRAT.exe	95
PID 816 wrote to memory of 2180	816	cmd.exe	97
PID 816 wrote to memory of 2180	816	cmd.exe	97
PID 816 wrote to memory of 1428	816	cmd.exe	98
PID 816 wrote to memory of 1428	816	cmd.exe	98
PID 816 wrote to memory of 4764	816	cmd.exe	99
PID 816 wrote to memory of 4764	816	cmd.exe	99
PID 816 wrote to memory of 2144	816	cmd.exe	100
PID 816 wrote to memory of 2144	816	cmd.exe	100
PID 2144 wrote to memory of 2468	2144	rat.exe	102
PID 2144 wrote to memory of 2468	2144	rat.exe	102
PID 2584 wrote to memory of 2156	2584	firefox.exe	113
PID 2584 wrote to memory of 2156	2584	firefox.exe	113
PID 2584 wrote to memory of 2156	2584	firefox.exe	113
PID 2584 wrote to memory of 2156	2584	firefox.exe	113
PID 2584 wrote to memory of 2156	2584	firefox.exe	113
PID 2584 wrote to memory of 2156	2584	firefox.exe	113
PID 2584 wrote to memory of 2156	2584	firefox.exe	113
PID 2584 wrote to memory of 2156	2584	firefox.exe	113
PID 2584 wrote to memory of 2156	2584	firefox.exe	113
PID 2584 wrote to memory of 2156	2584	firefox.exe	113
PID 2584 wrote to memory of 2156	2584	firefox.exe	113
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114
PID 2156 wrote to memory of 3708	2156	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpC294.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpC294.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 4428"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1428
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4764
- - C:\Users\ToxicEye\rat.exe
    "rat.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pornhub.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa972146f8,0x7ffa97214708,0x7ffa97214718
        5⤵
        
        PID:5792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11827017810546408278,15816293121367759726,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
        5⤵
        
        PID:6008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11827017810546408278,15816293121367759726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
        5⤵
        
        PID:4480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,11827017810546408278,15816293121367759726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
        5⤵
        
        PID:4436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11827017810546408278,15816293121367759726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
        5⤵
        
        PID:3644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11827017810546408278,15816293121367759726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
        5⤵
        
        PID:3960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11827017810546408278,15816293121367759726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
        5⤵
        
        PID:5348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11827017810546408278,15816293121367759726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2452 /prefetch:1
        5⤵
        
        PID:4924

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b455db27-62ef-4bcd-b8dd-cee49f5dfaa9} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" gpu
    3⤵
    PID:3708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2324 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75e0d095-1d2f-4707-b064-d12d4e48c548} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" socket
    3⤵
    PID:3432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3128 -childID 1 -isForBrowser -prefsHandle 2932 -prefMapHandle 3148 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71d7bfd5-a069-43ec-bc39-fcd54d8c1549} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:4344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3904 -childID 2 -isForBrowser -prefsHandle 3900 -prefMapHandle 3896 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a725bb9f-e08a-46e5-bdb5-42ac73a3f963} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:2288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4748 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4840 -prefMapHandle 4788 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4345598-7302-4121-abd2-d0e0c01bde67} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" utility
    3⤵
    - Checks processor information in registry
    PID:5568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2524 -childID 3 -isForBrowser -prefsHandle 5288 -prefMapHandle 5308 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d1b96a6-4e05-4496-a747-bfed2393deba} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:5908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5496 -childID 4 -isForBrowser -prefsHandle 5504 -prefMapHandle 5508 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {845273b6-6eb8-40ce-8ba4-b322837ac7bf} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 5 -isForBrowser -prefsHandle 5704 -prefMapHandle 5712 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1260 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b1c51ad-a0a1-4d50-8c91-723df76140ed} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:5932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery