8e048aa41cf6a60f00417a7a7fe9d2c95b1b2b64babf7ba781ab59ebd134f339

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ = "C:\\Windows\\SysWOW64\\rundll32.exe:*:Enabled:rundll32"	rundll32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	rundll32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	rundll32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	rundll32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	rundll32.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\rbadma.sys\ = "Driver"	rundll32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\rbadma.sys	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	rundll32.exe

Modifies Security services 2 TTPs 2 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "1"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\hrpdcf.bin	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\chinastar.key	rundll32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	3952	WerFault.exe	73

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\{2670000A-7350-4F3C-8081-5663EE0C6C49}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "526"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "493"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "397"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "397"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "364"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "364"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3952	rundll32.exe
3952	rundll32.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe
3952	rundll32.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	firefox.exe
Token: SeDebugPrivilege	4060	firefox.exe
Token: SeDebugPrivilege	2548	taskmgr.exe
Token: SeSystemProfilePrivilege	2548	taskmgr.exe
Token: SeCreateGlobalPrivilege	2548	taskmgr.exe
Token: 33	2548	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2548	taskmgr.exe
Token: SeDebugPrivilege	4348	firefox.exe
Token: SeDebugPrivilege	4348	firefox.exe
Token: 33	2532	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2532	AUDIODG.EXE
Token: 33	4348	firefox.exe
Token: SeIncBasePriorityPrivilege	4348	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4060	firefox.exe
4060	firefox.exe
4060	firefox.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe
2548	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4060	firefox.exe
5016	SearchUI.exe
4348	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3952	2084	rundll32.exe	73
PID 2084 wrote to memory of 3952	2084	rundll32.exe	73
PID 2084 wrote to memory of 3952	2084	rundll32.exe	73
PID 1992 wrote to memory of 4060	1992	firefox.exe	76
PID 1992 wrote to memory of 4060	1992	firefox.exe	76
PID 1992 wrote to memory of 4060	1992	firefox.exe	76
PID 1992 wrote to memory of 4060	1992	firefox.exe	76
PID 1992 wrote to memory of 4060	1992	firefox.exe	76
PID 1992 wrote to memory of 4060	1992	firefox.exe	76
PID 1992 wrote to memory of 4060	1992	firefox.exe	76
PID 1992 wrote to memory of 4060	1992	firefox.exe	76
PID 1992 wrote to memory of 4060	1992	firefox.exe	76
PID 1992 wrote to memory of 4060	1992	firefox.exe	76
PID 1992 wrote to memory of 4060	1992	firefox.exe	76
PID 4060 wrote to memory of 3496	4060	firefox.exe	77
PID 4060 wrote to memory of 3496	4060	firefox.exe	77
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78
PID 4060 wrote to memory of 948	4060	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d61cdfc3d8498f40ec41398a38ca1ac1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d61cdfc3d8498f40ec41398a38ca1ac1_JaffaCakes118.dll,#1
  2⤵
  - Modifies firewall policy service
  - Impair Defenses: Safe Mode Boot
  - Installs/modifies Browser Helper Object
  - Modifies Security services
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 948
    3⤵
    - Program crash
    PID:4524

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.0.250749892\1716472215" -parentBuildID 20221007134813 -prefsHandle 1720 -prefMapHandle 1712 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4131e165-3e32-46a1-9a47-0e8b266e902e} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 1796 1651d8ceb58 gpu
    3⤵
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.1.122949103\2119808670" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53181914-c58a-4565-adc9-99cd26ffae91} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 2152 1650b572858 socket
    3⤵
    - Checks processor information in registry
    PID:948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.2.1993344645\1344694080" -childID 1 -isForBrowser -prefsHandle 3080 -prefMapHandle 2800 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2061796-2e86-430e-8b2e-3530bc717b5d} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 2864 1651d85de58 tab
    3⤵
    PID:1264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.3.1400195700\299915096" -childID 2 -isForBrowser -prefsHandle 1208 -prefMapHandle 2796 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c949334b-e266-4107-8864-05d7c7dc8cf7} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 3448 165221d3458 tab
    3⤵
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.4.1360266108\164033831" -childID 3 -isForBrowser -prefsHandle 4372 -prefMapHandle 4368 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {016b8094-8e8f-4e46-8d29-efeab0d0c467} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 4380 16522ac0158 tab
    3⤵
    PID:4636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.5.1774869471\482184156" -childID 4 -isForBrowser -prefsHandle 4960 -prefMapHandle 4956 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b1cdbe4-fe8c-41cd-975f-1262761b2f1c} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 4968 165243e5858 tab
    3⤵
    PID:1924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.6.1873338947\872888643" -childID 5 -isForBrowser -prefsHandle 5104 -prefMapHandle 5108 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa3f6505-585a-4c6d-b228-914d2b2e640f} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 5092 165243e5e58 tab
    3⤵
    PID:68
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.7.644099680\1677344968" -childID 6 -isForBrowser -prefsHandle 5292 -prefMapHandle 5296 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {679b5cd5-9990-439e-93ce-48adb13488db} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 5376 165243e6158 tab
    3⤵
    PID:376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.8.490126278\438127517" -childID 7 -isForBrowser -prefsHandle 5776 -prefMapHandle 5772 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb5abcab-6f12-476f-8bba-169cb914738a} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 5800 1652616dc58 tab
    3⤵
    PID:2920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.9.1114138037\539828724" -childID 8 -isForBrowser -prefsHandle 4540 -prefMapHandle 4144 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc995f1e-3dc9-4834-b442-d436ca9de258} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 4104 16520197d58 tab
    3⤵
    PID:952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4060.10.918095985\1073143648" -childID 9 -isForBrowser -prefsHandle 3576 -prefMapHandle 4444 -prefsLen 27459 -prefMapSize 233444 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf89cb25-f34f-4034-90d2-b56449d5f86d} 4060 "\\.\pipe\gecko-crash-server-pipe.4060" 2684 1651d860258 tab
    3⤵
    PID:4840

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc NDIS NDIS-20240909-1122.dmp
1⤵
PID:4544

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2548

\??\c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:4520

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5016

\??\c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:4828

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1328
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4348.0.373720491\304969059" -parentBuildID 20221007134813 -prefsHandle 1592 -prefMapHandle 1580 -prefsLen 21551 -prefMapSize 233863 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5982434-c0f6-48f5-b941-098c858c25d8} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" 1704 2f095ffc358 gpu
    3⤵
    PID:3668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4348.1.648378854\602248082" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 21596 -prefMapSize 233863 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {357ed325-bd74-4182-a5bc-872285f98920} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" 2004 2f095c36158 socket
    3⤵
    PID:3688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4348.2.1338971838\1253835880" -childID 1 -isForBrowser -prefsHandle 2768 -prefMapHandle 2764 -prefsLen 22057 -prefMapSize 233863 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {61818946-d9aa-4e8c-800c-d80fe0002c31} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" 2668 2f099a34f58 tab
    3⤵
    PID:1264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4348.3.1545017482\379521732" -childID 2 -isForBrowser -prefsHandle 1248 -prefMapHandle 1044 -prefsLen 27235 -prefMapSize 233863 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b48747d6-0c0f-449e-b005-a71e10e08601} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" 2400 2f08b062558 tab
    3⤵
    PID:4816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4348.4.412732282\52497067" -childID 3 -isForBrowser -prefsHandle 3772 -prefMapHandle 3760 -prefsLen 27235 -prefMapSize 233863 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b18c9ec-7f59-4c32-bccb-baf063a8efb6} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" 3784 2f09a2ca858 tab
    3⤵
    PID:4864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4348.5.1947198616\832441095" -childID 4 -isForBrowser -prefsHandle 4472 -prefMapHandle 4372 -prefsLen 27235 -prefMapSize 233863 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3683064-0faf-458b-a4c2-c4e5a1d89d8d} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" 4508 2f0986f6a58 tab
    3⤵
    PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4348.6.1284102923\1544485501" -childID 5 -isForBrowser -prefsHandle 4700 -prefMapHandle 4704 -prefsLen 27235 -prefMapSize 233863 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f77260b-8409-4c66-9e0a-8f4b8bb2eb72} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" 4692 2f09b198c58 tab
    3⤵
    PID:212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4348.7.725299164\633734684" -childID 6 -isForBrowser -prefsHandle 4888 -prefMapHandle 4892 -prefsLen 27235 -prefMapSize 233863 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbbb1aca-de3b-47be-b10f-068596df175e} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" 4880 2f09c2d1858 tab
    3⤵
    PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4348.8.737093177\1936158789" -parentBuildID 20221007134813 -prefsHandle 4700 -prefMapHandle 4764 -prefsLen 27235 -prefMapSize 233863 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a2c1584-e89f-485e-a07f-0cc9c3883c28} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" 5196 2f09db38c58 rdd
    3⤵
    PID:4296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4348.9.1656697108\1231599946" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5376 -prefMapHandle 5388 -prefsLen 27235 -prefMapSize 233863 -appDir "C:\Program Files\Mozilla Firefox\browser" - {76c9a6a4-08c1-439c-bfad-4829f1d773cc} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" 5380 2f09da5b058 utility
    3⤵
    PID:3488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4348.10.1778070596\523268209" -childID 7 -isForBrowser -prefsHandle 5576 -prefMapHandle 5568 -prefsLen 27235 -prefMapSize 233863 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f98072e8-e046-45ce-aeb4-b6c18c2ef959} 4348 "\\.\pipe\gecko-crash-server-pipe.4348" 5400 2f09e60d258 tab
    3⤵
    PID:4656

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a5b055 /state1:0x41c64e6d
1⤵
PID:6736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery