49998dd0366a3d7dff3ec1b6c2add1c0f7283b42198273980025a41942bd8178

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	DB.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\QRELF = "C:\\Windows\\SysWOW64\\WSClientr.exe"	DB.EXE

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	WSClientr.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DB.EXE

Executes dropped EXE 11 IoCs

pid	Process
5648	[email protected]
4240	Google Chrome.exe
5504	Google Chrome.exe
3152	Google Chrome.exe
1568	[email protected]
420	AV.EXE
5800	AV2.EXE
5816	DB.EXE
5820	EN.EXE
3336	SB.EXE
1308	WSClientr.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5820-6197-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/5816-6200-0x0000000000690000-0x0000000000723000-memory.dmp	upx
behavioral1/memory/5816-6199-0x0000000000690000-0x0000000000723000-memory.dmp	upx
behavioral1/memory/5816-6193-0x0000000000690000-0x0000000000723000-memory.dmp	upx
behavioral1/memory/5816-6190-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/5816-6214-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/5820-6220-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/5800-6215-0x0000000000400000-0x00000000004C3000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DB.EXE

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
222	raw.githubusercontent.com
224	raw.githubusercontent.com
242	camo.githubusercontent.com
243	camo.githubusercontent.com
244	camo.githubusercontent.com
221	raw.githubusercontent.com
223	raw.githubusercontent.com
245	camo.githubusercontent.com
821	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\physicaldrive0	SB.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WSClientr.exe	DB.EXE
File opened for modification	C:\Windows\SysWOW64\WSClientr.exe	DB.EXE

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Google Chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Google Chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Google Chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EN.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV.EXE

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000d86b51af3abb5fd60a19741c8d1ba9cc18c023d86ece163777af04d565e815cea0a9c120e121d00b14855f8b18b0d21a2a867d66c0b027accd39	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b97eb76a82f9da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 780adf7082f9da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30530A0C86EDB1CD5A2A5FE37EF3BF28E69BE16D	AV.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30530A0C86EDB1CD5A2A5FE37EF3BF28E69BE16D\Blob = 03000000010000001400000030530a0c86edb1cd5a2a5fe37ef3bf28e69be16d2000000001000000b3020000308202af308202180209009168978ee53f5964300d06092a864886f70d010105050030819b310b30090603550406130255533110300e06035504081307566972676e69613110300e060355040713074e65776275727931123010060355040a13094261636f72204c4c43312330210603550403131a746f74616c736f6c7574696f6e616e746976697275732e636f6d312f302d06092a864886f70d010901162061646d696e40746f74616c736f6c7574696f6e616e746976697275732e636f6d301e170d3131303931383131313834395a170d3132303931373131313834395a30819b310b30090603550406130255533110300e06035504081307566972676e69613110300e060355040713074e65776275727931123010060355040a13094261636f72204c4c43312330210603550403131a746f74616c736f6c7574696f6e616e746976697275732e636f6d312f302d06092a864886f70d010901162061646d696e40746f74616c736f6c7574696f6e616e746976697275732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100cac8419346518527133fdefd7982ac3919f1d6e2f815ecab0b5d219ccf843885645cfd9c35cae2eff8e7506e690b52c587a59c8d667cb671454030bd370fa334b18afb5ea4f4f819a36685a705a8543f320af913ca680a1d32a402db6d3e42d93228e44ba230fda524d490ddc35b922f23d36d95417136ac50afa567e21359350203010001300d06092a864886f70d0101050500038181003c6a7f43ca2cee1caafee88b04777032a4c9d7794222537e3ebe57953198281bdbe0d3a58f7d3eb358f361848f30ad88a364cd0ae3376e6239dedb01497d52d3dd55e78e49375373419ad7e5e2e036f713bf4d96a552f2aa26b35b66d7a83fb2a9b6e317d162d8342f09ccc71b2a1c7d9474ca7872bfa4acd623d61c4491d740	AV.EXE

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Fake BSOD.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Hydra.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\You-are-an-idiot.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Ana.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
5816	DB.EXE
5816	DB.EXE
5816	DB.EXE
5816	DB.EXE

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
5612	MicrosoftEdgeCP.exe
5612	MicrosoftEdgeCP.exe
5612	MicrosoftEdgeCP.exe
5612	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	firefox.exe
Token: SeDebugPrivilege	2368	firefox.exe
Token: SeDebugPrivilege	2368	firefox.exe
Token: SeDebugPrivilege	2368	firefox.exe
Token: SeDebugPrivilege	2368	firefox.exe
Token: SeDebugPrivilege	2368	firefox.exe
Token: SeRestorePrivilege	1820	7zG.exe
Token: 35	1820	7zG.exe
Token: SeSecurityPrivilege	1820	7zG.exe
Token: SeSecurityPrivilege	1820	7zG.exe
Token: SeDebugPrivilege	5700	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5700	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5700	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5700	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5792	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5792	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5792	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5252	MicrosoftEdge.exe
Token: SeDebugPrivilege	5252	MicrosoftEdge.exe
Token: SeDebugPrivilege	2368	firefox.exe
Token: SeRestorePrivilege	4616	7zG.exe
Token: 35	4616	7zG.exe
Token: SeSecurityPrivilege	4616	7zG.exe
Token: SeSecurityPrivilege	4616	7zG.exe
Token: SeDebugPrivilege	2980	taskmgr.exe
Token: SeSystemProfilePrivilege	2980	taskmgr.exe
Token: SeCreateGlobalPrivilege	2980	taskmgr.exe
Token: SeDebugPrivilege	2368	firefox.exe
Token: 33	2980	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2980	taskmgr.exe
Token: SeDebugPrivilege	2368	firefox.exe
Token: SeDebugPrivilege	2368	firefox.exe
Token: SeRestorePrivilege	5588	7zG.exe
Token: 35	5588	7zG.exe
Token: SeSecurityPrivilege	5588	7zG.exe
Token: SeSecurityPrivilege	5588	7zG.exe
Token: SeDebugPrivilege	3868	taskmgr.exe
Token: SeSystemProfilePrivilege	3868	taskmgr.exe
Token: SeCreateGlobalPrivilege	3868	taskmgr.exe
Token: 33	3868	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3868	taskmgr.exe
Token: SeDebugPrivilege	2368	firefox.exe
Token: SeDebugPrivilege	2368	firefox.exe
Token: SeDebugPrivilege	4752	firefox.exe
Token: SeDebugPrivilege	4752	firefox.exe
Token: SeDebugPrivilege	4752	firefox.exe
Token: SeDebugPrivilege	4752	firefox.exe
Token: SeDebugPrivilege	4752	firefox.exe
Token: SeDebugPrivilege	4752	firefox.exe
Token: SeRestorePrivilege	4472	7zG.exe
Token: 35	4472	7zG.exe
Token: SeSecurityPrivilege	4472	7zG.exe
Token: SeSecurityPrivilege	4472	7zG.exe
Token: SeDebugPrivilege	5816	DB.EXE
Token: SeShutdownPrivilege	3336	SB.EXE
Token: SeIncBasePriorityPrivilege	5820	EN.EXE
Token: SeDebugPrivilege	5800	AV2.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
1820	7zG.exe
4616	7zG.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
5648	[email protected]
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe
2980	taskmgr.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
5252	MicrosoftEdge.exe
5612	MicrosoftEdgeCP.exe
5700	MicrosoftEdgeCP.exe
5612	MicrosoftEdgeCP.exe
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
4240	Google Chrome.exe
4240	Google Chrome.exe
5504	Google Chrome.exe
5504	Google Chrome.exe
3152	Google Chrome.exe
3152	Google Chrome.exe
2368	firefox.exe
2368	firefox.exe
2368	firefox.exe
4752	firefox.exe
4752	firefox.exe
4752	firefox.exe
4752	firefox.exe
1308	WSClientr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2368	1316	firefox.exe	76
PID 1316 wrote to memory of 2368	1316	firefox.exe	76
PID 1316 wrote to memory of 2368	1316	firefox.exe	76
PID 1316 wrote to memory of 2368	1316	firefox.exe	76
PID 1316 wrote to memory of 2368	1316	firefox.exe	76
PID 1316 wrote to memory of 2368	1316	firefox.exe	76
PID 1316 wrote to memory of 2368	1316	firefox.exe	76
PID 1316 wrote to memory of 2368	1316	firefox.exe	76
PID 1316 wrote to memory of 2368	1316	firefox.exe	76
PID 1316 wrote to memory of 2368	1316	firefox.exe	76
PID 1316 wrote to memory of 2368	1316	firefox.exe	76
PID 2368 wrote to memory of 4016	2368	firefox.exe	77
PID 2368 wrote to memory of 4016	2368	firefox.exe	77
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 3124	2368	firefox.exe	78
PID 2368 wrote to memory of 1712	2368	firefox.exe	79
PID 2368 wrote to memory of 1712	2368	firefox.exe	79
PID 2368 wrote to memory of 1712	2368	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-08-28 at 14.57.55.png"
1⤵
PID:4092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.0.92726478\358827857" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c277f5a9-ec23-4761-b39f-293a6d158985} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 1776 1677f3e4258 gpu
    3⤵
    PID:4016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.1.977090377\13900574" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5acb2dbb-03f0-409a-89b4-d697400eb346} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 2132 1677ba6f858 socket
    3⤵
    - Checks processor information in registry
    PID:3124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.2.332042446\646126421" -childID 1 -isForBrowser -prefsHandle 2704 -prefMapHandle 2812 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba6b34ac-5315-4c58-9815-71c1a52b8ebe} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 2668 1670adc7e58 tab
    3⤵
    PID:1712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.3.234620649\890255852" -childID 2 -isForBrowser -prefsHandle 1564 -prefMapHandle 2512 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d5d2f5c-f0d8-4076-97cd-e6c13b0ab687} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 3276 167093b2858 tab
    3⤵
    PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.4.258227397\124445835" -childID 3 -isForBrowser -prefsHandle 3768 -prefMapHandle 3764 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd0a9762-c513-405d-abb6-2992389132fa} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 1188 1670b3bfe58 tab
    3⤵
    PID:4272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.5.556578658\1521747490" -childID 4 -isForBrowser -prefsHandle 4932 -prefMapHandle 4956 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a73b05e-b060-4130-ab3a-09806c7d6052} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 4936 1670d319458 tab
    3⤵
    PID:1584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.6.881205950\1900129843" -childID 5 -isForBrowser -prefsHandle 4996 -prefMapHandle 5000 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78ca87ef-f6f6-4ae3-909e-aea3f79a619e} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 5080 1670d4f7758 tab
    3⤵
    PID:3224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.7.1402819385\1184970855" -childID 6 -isForBrowser -prefsHandle 5200 -prefMapHandle 5204 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c47b75ce-8689-40d8-a93b-af2ae4030b3c} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 5192 1670d4f7158 tab
    3⤵
    PID:5072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.8.2098997000\265285529" -childID 7 -isForBrowser -prefsHandle 5812 -prefMapHandle 5804 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fbb26ce-5469-4418-9d97-f2b59e5d6e9a} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 5796 1670f337858 tab
    3⤵
    PID:3592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.9.1678020008\1282878277" -childID 8 -isForBrowser -prefsHandle 5104 -prefMapHandle 5164 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {71adc1ae-f550-464a-bf89-8babe6b6cb6e} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 5088 167101ab358 tab
    3⤵
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.10.1627824966\936127254" -childID 9 -isForBrowser -prefsHandle 5080 -prefMapHandle 5220 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {81577b5a-3870-4fab-ad0b-37498d512bfc} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 5936 167101abf58 tab
    3⤵
    PID:3336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.11.217010912\1275974464" -childID 10 -isForBrowser -prefsHandle 9704 -prefMapHandle 2624 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {18ba6035-c387-4bb2-ba51-16c7892d22f8} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 2616 1670f9ec758 tab
    3⤵
    PID:3904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.12.1570521188\841078869" -childID 11 -isForBrowser -prefsHandle 9652 -prefMapHandle 9676 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e93d7a41-eccc-4261-935b-db768bf60abe} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 9644 1670f9edf58 tab
    3⤵
    PID:2660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.13.1617894843\1299749556" -childID 12 -isForBrowser -prefsHandle 2724 -prefMapHandle 4192 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {69e3787a-2b22-442a-a625-10eb9934b5df} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 9612 1670f9cce58 tab
    3⤵
    PID:5248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.14.1419555953\1789395299" -childID 13 -isForBrowser -prefsHandle 9428 -prefMapHandle 9416 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f595dc9c-1969-43f4-903a-edd6a2e3cb8b} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 9292 1670f6d4758 tab
    3⤵
    PID:5344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.15.1012484026\169302829" -childID 14 -isForBrowser -prefsHandle 8984 -prefMapHandle 8972 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92a6a1f6-bb96-4c23-8dd3-d94777115ea6} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 6004 1670f9ee558 tab
    3⤵
    PID:2980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.16.1022700833\1490545731" -childID 15 -isForBrowser -prefsHandle 8852 -prefMapHandle 8848 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2964c754-5739-45e3-822e-cc2a74ab6196} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 9180 16710255358 tab
    3⤵
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.17.457241186\130767163" -childID 16 -isForBrowser -prefsHandle 8248 -prefMapHandle 8276 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9addcdd8-04d6-4977-9155-203819978010} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 8204 167147d8e58 tab
    3⤵
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.18.2052021869\1299119938" -childID 17 -isForBrowser -prefsHandle 8220 -prefMapHandle 8236 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb10aea3-b0d1-44b9-9aa5-f8c8f73e7eab} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 8136 167130be258 tab
    3⤵
    PID:4212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.19.550086705\1364402474" -parentBuildID 20221007134813 -prefsHandle 8408 -prefMapHandle 3004 -prefsLen 26826 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6527d46f-74fd-45aa-b655-d71809f7b67c} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 9228 16712df3658 rdd
    3⤵
    PID:424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.20.1121518741\1580512027" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 8660 -prefMapHandle 8648 -prefsLen 26826 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f54218e-47b8-447d-afc5-64d7f6715d59} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 9612 16712df3958 utility
    3⤵
    PID:2148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.21.373045507\963672716" -childID 18 -isForBrowser -prefsHandle 8980 -prefMapHandle 9172 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3774481-0daa-42c2-b59b-b0f90aecbf86} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 9408 16709bef558 tab
    3⤵
    PID:5888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.22.1482518253\307507219" -childID 19 -isForBrowser -prefsHandle 7764 -prefMapHandle 8412 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39e1524c-a1fa-41ef-bd95-a7744956d17d} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 8432 1671368d458 tab
    3⤵
    PID:5560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.23.1470047710\1422187450" -childID 20 -isForBrowser -prefsHandle 8260 -prefMapHandle 8244 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28eaa24e-7593-49e2-8b61-3b443cbdeffa} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 8308 16713feca58 tab
    3⤵
    PID:3336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.24.1470445518\1726126967" -childID 21 -isForBrowser -prefsHandle 8692 -prefMapHandle 8688 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58a23e94-e994-4a7d-b398-a08a00a2dcd1} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 9656 167145be458 tab
    3⤵
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.25.2039446102\490017311" -childID 22 -isForBrowser -prefsHandle 6020 -prefMapHandle 5276 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d95bad5-7727-49d4-bd0d-d79c6aa534d3} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 4180 16713769458 tab
    3⤵
    PID:5632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2368.26.1152174877\488862401" -childID 23 -isForBrowser -prefsHandle 8756 -prefMapHandle 8688 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1276 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc99da81-b578-4a51-a4e9-03c726a5c2ec} 2368 "\\.\pipe\gecko-crash-server-pipe.2368" 8392 16714566f58 tab
    3⤵
    PID:1404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6056

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Virus\" -an -ai#7zMap14665:92:7zEvent24304
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5252

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5404

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5612

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5700

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Virus\" -an -ai#7zMap21501:84:7zEvent15172
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4616

C:\Users\Admin\Downloads\Virus\[email protected]
"C:\Users\Admin\Downloads\Virus\[email protected]"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:5648

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2980

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Virus\" -an -ai#7zMap24035:106:7zEvent11648
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Users\Admin\Downloads\Virus\Google Chrome.exe
"C:\Users\Admin\Downloads\Virus\Google Chrome.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4240

C:\Users\Admin\Downloads\Virus\Google Chrome.exe
"C:\Users\Admin\Downloads\Virus\Google Chrome.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5504

C:\Users\Admin\Downloads\Virus\Google Chrome.exe
"C:\Users\Admin\Downloads\Virus\Google Chrome.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3152

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\330358ed32374caf82000b67c1498b2b /t 4904 /p 4240
1⤵
PID:5548

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5300
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.0.1440228071\853811243" -parentBuildID 20221007134813 -prefsHandle 1560 -prefMapHandle 1580 -prefsLen 21163 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {659142c1-d87e-4dc8-809d-b4c5f03da73c} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 1664 22db76fb658 gpu
    3⤵
    PID:5304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.1.561718524\7689398" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 21208 -prefMapSize 233583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80a97d7a-535b-45df-b519-4c5356d2d1dd} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 2004 22dacae7058 socket
    3⤵
    PID:4440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.2.1846442277\739550168" -childID 1 -isForBrowser -prefsHandle 2660 -prefMapHandle 2668 -prefsLen 21669 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8e66405-15d3-450c-ba4a-6fcce10a8e4e} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 2536 22dbb6d8258 tab
    3⤵
    PID:904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.3.1751732360\1933228885" -childID 2 -isForBrowser -prefsHandle 1296 -prefMapHandle 1272 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f527ce2-0a49-4929-9d49-9663edc54b12} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 3188 22daca62b58 tab
    3⤵
    PID:3872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.4.1374102200\1213666364" -childID 3 -isForBrowser -prefsHandle 3616 -prefMapHandle 3648 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {352a5e98-1ce7-47bc-9776-d19cd7f7fd7b} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 3676 22dbc7fa558 tab
    3⤵
    PID:6140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.5.1435664260\809824121" -childID 4 -isForBrowser -prefsHandle 4436 -prefMapHandle 4452 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9792b92-f8aa-41aa-bed4-71cf8810e193} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 4440 22dba281e58 tab
    3⤵
    PID:3104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.6.872990273\265642806" -childID 5 -isForBrowser -prefsHandle 4520 -prefMapHandle 4524 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c045e862-0f73-436e-9189-df02abc600c7} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 4624 22dbde39e58 tab
    3⤵
    PID:3664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.7.1105286190\705930128" -childID 6 -isForBrowser -prefsHandle 4832 -prefMapHandle 4836 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cd9306a-9021-4764-b74a-c71fdc68bbd9} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 4824 22dbdea4558 tab
    3⤵
    PID:2512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.8.213406487\1223747871" -childID 7 -isForBrowser -prefsHandle 5416 -prefMapHandle 5372 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {32e75ef5-4779-4059-8ed2-c58d0a94aacc} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 5376 22dc0462e58 tab
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.9.1307893323\318621863" -parentBuildID 20221007134813 -prefsHandle 5336 -prefMapHandle 5352 -prefsLen 26847 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9083ec26-42cf-439a-8a9b-249895039ccc} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 5588 22dbc541958 rdd
    3⤵
    PID:3684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.10.1511456446\2081126513" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5664 -prefMapHandle 5668 -prefsLen 26847 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {adb1286c-af93-4c7a-a926-99bd328e66a3} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 3696 22dbd251658 utility
    3⤵
    PID:5108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.11.580970462\2094923780" -childID 8 -isForBrowser -prefsHandle 5256 -prefMapHandle 5644 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {473aca8e-6957-4b4c-bd87-fefd3b61a590} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 9744 22dbc80d958 tab
    3⤵
    PID:1688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.12.1382347537\275517459" -childID 9 -isForBrowser -prefsHandle 9480 -prefMapHandle 4236 -prefsLen 27391 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7b0cfd9-a9ea-4d32-8939-79e51b5cb9c6} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 9468 22daca5ca58 tab
    3⤵
    PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.13.116924756\148343165" -childID 10 -isForBrowser -prefsHandle 9368 -prefMapHandle 9364 -prefsLen 27391 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63c48f99-45bd-43e7-81d2-3205b15b773c} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 9376 22dbc8f2e58 tab
    3⤵
    PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.14.1305096580\1997877764" -childID 11 -isForBrowser -prefsHandle 5420 -prefMapHandle 5368 -prefsLen 27391 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21a5ad19-19bc-4fce-a379-da011491f261} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 5508 22dbfdcae58 tab
    3⤵
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.15.2111080939\1255992803" -childID 12 -isForBrowser -prefsHandle 4816 -prefMapHandle 2320 -prefsLen 27391 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {735b4a17-e467-48bd-991d-480d1973a594} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 9376 22dbd250158 tab
    3⤵
    PID:1032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.16.1658535456\1533905565" -childID 13 -isForBrowser -prefsHandle 8768 -prefMapHandle 8784 -prefsLen 27391 -prefMapSize 233583 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f088476-9b9c-45de-9193-7b8a12aa4c99} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 8776 22dc0586658 tab
    3⤵
    PID:5924

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Virus\" -an -ai#7zMap7430:80:7zEvent24578
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Users\Admin\Downloads\Virus\[email protected]
"C:\Users\Admin\Downloads\Virus\[email protected]"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1568
- C:\Users\Admin\AppData\Local\Temp\AV.EXE
  "C:\Users\Admin\AppData\Local\Temp\AV.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:420
- C:\Users\Admin\AppData\Local\Temp\AV2.EXE
  "C:\Users\Admin\AppData\Local\Temp\AV2.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5800
- C:\Users\Admin\AppData\Local\Temp\DB.EXE
  "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
  2⤵
  - Adds policy Run key to start application
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5816
- - C:\Windows\SysWOW64\WSClientr.exe
    C:\Windows\SysWOW64\WSClientr.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1308
- - C:\Windows\SysWOW64\cmd.exe
    /c C:\Users\Admin\AppData\Local\Temp\~unins1734.bat "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
    3⤵
    PID:3356
- C:\Users\Admin\AppData\Local\Temp\EN.EXE
  "C:\Users\Admin\AppData\Local\Temp\EN.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5820
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EN.EXE > nul
    3⤵
    PID:1488
- C:\Users\Admin\AppData\Local\Temp\SB.EXE
  "C:\Users\Admin\AppData\Local\Temp\SB.EXE"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery