mercurialgrabber | hxxps://mega[.]nz/file/gip0kLJT#uJR9tA_Mh5MY5P87xYgnl8pxe-n4MFv9fe9Rnxo7UTk

Virtualization/Sandbox Evasion

Processes:

Start Chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Start Chrome.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

Start Chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	Start Chrome.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Start Chrome.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Start Chrome.exe

Executes dropped EXE 1 IoCs

Processes:

Start Chrome.exe

pid	Process
5484	Start Chrome.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
182	ip4.seeip.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Start Chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Start Chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Start Chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 1 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Start Chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	Start Chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

System Information Discovery

Processes:

Start Chrome.exemsedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	Start Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	Start Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	Start Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	Start Chrome.exe

Modifies registry class 2 IoCs

Processes:

firefox.exeOpenWith.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description	ioc	Process
File created	C:\Users\Admin\Downloads\Fivem_Hacker.rar:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
5956	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid	Process
5952	msedge.exe
5952	msedge.exe
5708	msedge.exe
5708	msedge.exe
4652	identity_helper.exe
4652	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid	Process
2280	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid	Process
5708	msedge.exe
5708	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

firefox.exeAUDIODG.EXE7zG.exeStart Chrome.exe

description	pid	Process
Token: SeDebugPrivilege	3268	firefox.exe
Token: SeDebugPrivilege	3268	firefox.exe
Token: 33	924	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	924	AUDIODG.EXE
Token: SeDebugPrivilege	3268	firefox.exe
Token: SeRestorePrivilege	4856	7zG.exe
Token: 35	4856	7zG.exe
Token: SeSecurityPrivilege	4856	7zG.exe
Token: SeSecurityPrivilege	4856	7zG.exe
Token: SeDebugPrivilege	5484	Start Chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

Processes:

firefox.exe7zG.exemsedge.exe

pid	Process
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
4856	7zG.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe

Suspicious use of SendNotifyMessage 44 IoCs

Processes:

firefox.exemsedge.exe

pid	Process
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe
5708	msedge.exe

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

firefox.exeOpenWith.exe

pid	Process
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe
2280	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	Process	procid_target
PID 3160 wrote to memory of 3268	3160	firefox.exe	83
PID 3160 wrote to memory of 3268	3160	firefox.exe	83
PID 3160 wrote to memory of 3268	3160	firefox.exe	83
PID 3160 wrote to memory of 3268	3160	firefox.exe	83
PID 3160 wrote to memory of 3268	3160	firefox.exe	83
PID 3160 wrote to memory of 3268	3160	firefox.exe	83
PID 3160 wrote to memory of 3268	3160	firefox.exe	83
PID 3160 wrote to memory of 3268	3160	firefox.exe	83
PID 3160 wrote to memory of 3268	3160	firefox.exe	83
PID 3160 wrote to memory of 3268	3160	firefox.exe	83
PID 3160 wrote to memory of 3268	3160	firefox.exe	83
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 1596	3268	firefox.exe	84
PID 3268 wrote to memory of 4280	3268	firefox.exe	85
PID 3268 wrote to memory of 4280	3268	firefox.exe	85
PID 3268 wrote to memory of 4280	3268	firefox.exe	85
PID 3268 wrote to memory of 4280	3268	firefox.exe	85
PID 3268 wrote to memory of 4280	3268	firefox.exe	85
PID 3268 wrote to memory of 4280	3268	firefox.exe	85
PID 3268 wrote to memory of 4280	3268	firefox.exe	85
PID 3268 wrote to memory of 4280	3268	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://mega.nz/file/gip0kLJT#uJR9tA_Mh5MY5P87xYgnl8pxe-n4MFv9fe9Rnxo7UTk"
1⤵
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://mega.nz/file/gip0kLJT#uJR9tA_Mh5MY5P87xYgnl8pxe-n4MFv9fe9Rnxo7UTk
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37ea0a8f-dacd-4ab8-9f95-c7f2efb1c08e} 3268 "\\.\pipe\gecko-crash-server-pipe.3268" gpu
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79d0787a-b6b8-4af7-b616-db5bfc38b6b8} 3268 "\\.\pipe\gecko-crash-server-pipe.3268" socket
    3⤵
    PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3164 -childID 1 -isForBrowser -prefsHandle 2732 -prefMapHandle 3016 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1edcab97-c592-48bc-9a1f-5cca3c565b02} 3268 "\\.\pipe\gecko-crash-server-pipe.3268" tab
    3⤵
    PID:2668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3532 -childID 2 -isForBrowser -prefsHandle 3492 -prefMapHandle 3484 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bd32e12-95bd-4d65-8683-60e14dc39e35} 3268 "\\.\pipe\gecko-crash-server-pipe.3268" tab
    3⤵
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4316 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4340 -prefMapHandle 4336 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec28946a-2ba7-4569-969b-8813df6b69da} 3268 "\\.\pipe\gecko-crash-server-pipe.3268" utility
    3⤵
    - Checks processor information in registry
    PID:5016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5316 -childID 3 -isForBrowser -prefsHandle 5312 -prefMapHandle 5304 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc15fa52-ce62-4c3b-ac21-a6f5c2c42f17} 3268 "\\.\pipe\gecko-crash-server-pipe.3268" tab
    3⤵
    PID:2860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 4 -isForBrowser -prefsHandle 4344 -prefMapHandle 5016 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {549e15f8-3b58-4ca6-8e12-d65538882ca3} 3268 "\\.\pipe\gecko-crash-server-pipe.3268" tab
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5776 -childID 5 -isForBrowser -prefsHandle 5696 -prefMapHandle 5700 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb72effe-9048-4b60-8a30-69337136a366} 3268 "\\.\pipe\gecko-crash-server-pipe.3268" tab
    3⤵
    PID:1576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6136 -childID 6 -isForBrowser -prefsHandle 5864 -prefMapHandle 5884 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a9933ec-0bab-4b57-9891-1703247b5e9f} 3268 "\\.\pipe\gecko-crash-server-pipe.3268" tab
    3⤵
    PID:1612

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x394
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4580

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Fivem_Hacker\" -ad -an -ai#7zMap1010:86:7zEvent6052
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4856

C:\Users\Admin\Downloads\Fivem_Hacker\Fivem_Hacker\Start Chrome.exe
"C:\Users\Admin\Downloads\Fivem_Hacker\Fivem_Hacker\Start Chrome.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Fivem_Hacker\Fivem_Hacker\Fivem\credits.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa75db46f8,0x7ffa75db4708,0x7ffa75db4718
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,14384949611444903634,11902883141320525900,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,14384949611444903634,11902883141320525900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,14384949611444903634,11902883141320525900,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14384949611444903634,11902883141320525900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14384949611444903634,11902883141320525900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,14384949611444903634,11902883141320525900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,14384949611444903634,11902883141320525900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2280
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Fivem_Hacker\Fivem_Hacker\Fivem\nw_100_percent.pak
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion