dcrat | 5a3484f0aedd1a84750a5a3debf21a0f28efd20323ab55a0c89f622c27ebf9ad

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	hz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	Chainserversaves.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	MoUsoCoreWorker.exe

Executes dropped EXE 2 IoCs

pid	Process
1020	Chainserversaves.exe
3092	MoUsoCoreWorker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	ipinfo.io
33	ipinfo.io

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\55b276f4edf653	Chainserversaves.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\MoUsoCoreWorker.exe	Chainserversaves.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\1f93f77a7f4778	Chainserversaves.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\sihost.exe	Chainserversaves.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\66fc9ff0ee96c2	Chainserversaves.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\SppExtComObj.exe	Chainserversaves.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\e1ef82546f0b02	Chainserversaves.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\StartMenuExperienceHost.exe	Chainserversaves.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\dllhost.exe	Chainserversaves.exe
File created	C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\5940a34987c991	Chainserversaves.exe
File created	C:\Windows\Performance\WinSAT\DataStore\taskhostw.exe	Chainserversaves.exe
File created	C:\Windows\Performance\WinSAT\DataStore\ea9f0e6c9e2dcd	Chainserversaves.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hz.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
4276	taskkill.exe
4256	taskkill.exe
776	taskkill.exe
2072	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings	hz.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings	MoUsoCoreWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2140	schtasks.exe
4572	schtasks.exe
2248	schtasks.exe
1352	schtasks.exe
1772	schtasks.exe
2008	schtasks.exe
528	schtasks.exe
3612	schtasks.exe
2116	schtasks.exe
3196	schtasks.exe
4612	schtasks.exe
1708	schtasks.exe
1856	schtasks.exe
1908	schtasks.exe
3976	schtasks.exe
1324	schtasks.exe
3064	schtasks.exe
1748	schtasks.exe
4060	schtasks.exe
1356	schtasks.exe
2448	schtasks.exe
2424	schtasks.exe
3216	schtasks.exe
3248	schtasks.exe
464	schtasks.exe
2792	schtasks.exe
3164	schtasks.exe
4340	schtasks.exe
4972	schtasks.exe
992	schtasks.exe
4480	schtasks.exe
3444	schtasks.exe
988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1020	Chainserversaves.exe
1068	taskmgr.exe
1020	Chainserversaves.exe
1020	Chainserversaves.exe
1020	Chainserversaves.exe
1020	Chainserversaves.exe
1068	taskmgr.exe
3092	MoUsoCoreWorker.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
3092	MoUsoCoreWorker.exe
3092	MoUsoCoreWorker.exe
3092	MoUsoCoreWorker.exe
3092	MoUsoCoreWorker.exe
3092	MoUsoCoreWorker.exe
3092	MoUsoCoreWorker.exe
3092	MoUsoCoreWorker.exe
3092	MoUsoCoreWorker.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3092	MoUsoCoreWorker.exe
1068	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	taskmgr.exe
Token: SeSystemProfilePrivilege	1068	taskmgr.exe
Token: SeCreateGlobalPrivilege	1068	taskmgr.exe
Token: SeDebugPrivilege	1020	Chainserversaves.exe
Token: SeDebugPrivilege	3092	MoUsoCoreWorker.exe
Token: SeManageVolumePrivilege	2800	svchost.exe
Token: SeDebugPrivilege	1948	firefox.exe
Token: SeDebugPrivilege	1948	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1068	taskmgr.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1948	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2764	5076	hz.exe	81
PID 5076 wrote to memory of 2764	5076	hz.exe	81
PID 5076 wrote to memory of 2764	5076	hz.exe	81
PID 2764 wrote to memory of 4620	2764	WScript.exe	92
PID 2764 wrote to memory of 4620	2764	WScript.exe	92
PID 2764 wrote to memory of 4620	2764	WScript.exe	92
PID 4620 wrote to memory of 1020	4620	cmd.exe	94
PID 4620 wrote to memory of 1020	4620	cmd.exe	94
PID 1020 wrote to memory of 3092	1020	Chainserversaves.exe	128
PID 1020 wrote to memory of 3092	1020	Chainserversaves.exe	128
PID 3092 wrote to memory of 3076	3092	MoUsoCoreWorker.exe	129
PID 3092 wrote to memory of 3076	3092	MoUsoCoreWorker.exe	129
PID 3092 wrote to memory of 1484	3092	MoUsoCoreWorker.exe	130
PID 3092 wrote to memory of 1484	3092	MoUsoCoreWorker.exe	130
PID 3796 wrote to memory of 1948	3796	firefox.exe	139
PID 3796 wrote to memory of 1948	3796	firefox.exe	139
PID 3796 wrote to memory of 1948	3796	firefox.exe	139
PID 3796 wrote to memory of 1948	3796	firefox.exe	139
PID 3796 wrote to memory of 1948	3796	firefox.exe	139
PID 3796 wrote to memory of 1948	3796	firefox.exe	139
PID 3796 wrote to memory of 1948	3796	firefox.exe	139
PID 3796 wrote to memory of 1948	3796	firefox.exe	139
PID 3796 wrote to memory of 1948	3796	firefox.exe	139
PID 3796 wrote to memory of 1948	3796	firefox.exe	139
PID 3796 wrote to memory of 1948	3796	firefox.exe	139
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140
PID 1948 wrote to memory of 236	1948	firefox.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\hz.exe
"C:\Users\Admin\AppData\Local\Temp\hz.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\containerBrowserCrt\4vnGQCrxdBgDLRDnUuGXGsz.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\containerBrowserCrt\Q6T7BfYGFreOhBOdwu8a5XaE2q.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Users\Admin\AppData\Roaming\containerBrowserCrt\Chainserversaves.exe
      "C:\Users\Admin\AppData\Roaming\containerBrowserCrt\Chainserversaves.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\Program Files (x86)\Mozilla Maintenance Service\logs\MoUsoCoreWorker.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\MoUsoCoreWorker.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3092
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21d57b13-daab-49a5-8e1b-2ce16d9c773a.vbs"
        6⤵
        
        PID:3076
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c57df99a-3466-4ee1-ab1d-5b844597b0b7.vbs"
        6⤵
        
        PID:1484
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /f /im crss.exe & taskkill /f /im wininit.exe & taskkill /f /im winlogon.exe & taskkill /f /im svchost.exe
        6⤵
        
        PID:1764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im crss.exe
        7⤵
        Kills process with taskkill
        
        PID:4276
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im wininit.exe
        7⤵
        Kills process with taskkill
        
        PID:4256
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im winlogon.exe
        7⤵
        Kills process with taskkill
        
        PID:776
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im svchost.exe
        7⤵
        Kills process with taskkill
        
        PID:2072

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Windows\Performance\WinSAT\DataStore\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\DataStore\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Admin\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Videos\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\Videos\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Videos\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1852 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2c8523f-2873-4985-91c5-b70fcb791064} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" gpu
    3⤵
    PID:236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2308 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1a10b71-913c-4a97-a893-4cb6867dac72} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" socket
    3⤵
    PID:2324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2996 -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2972 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6e9adfa-0ca3-499c-9e30-3f626f789d68} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" tab
    3⤵
    PID:1700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1236 -childID 2 -isForBrowser -prefsHandle 4328 -prefMapHandle 4324 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9611d373-2902-4465-839e-b7468c933dc2} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" tab
    3⤵
    PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4940 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4924 -prefMapHandle 4904 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06d4a230-4994-4366-b2dc-af1c927fe673} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" utility
    3⤵
    - Checks processor information in registry
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5440 -childID 3 -isForBrowser -prefsHandle 5380 -prefMapHandle 5444 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1bf8677-ae68-435f-a65d-ffd726fafc0b} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" tab
    3⤵
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 4 -isForBrowser -prefsHandle 5576 -prefMapHandle 5584 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7da512a-42c6-45c0-a17e-07079b663262} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" tab
    3⤵
    PID:6136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5736 -childID 5 -isForBrowser -prefsHandle 5744 -prefMapHandle 5748 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bada0ef1-6821-45a3-9b5a-d8357d2c4a20} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" tab
    3⤵
    PID:5752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6228 -childID 6 -isForBrowser -prefsHandle 6184 -prefMapHandle 6180 -prefsLen 27566 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c69f217-00a8-43b5-9fd6-9afb3413e74c} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" tab
    3⤵
    PID:5352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery