amadey | 621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c07d69c6be.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c07d69c6be.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c07d69c6be.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c07d69c6be.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c07d69c6be.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c07d69c6be.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	ff7f8b5053.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

Query Registry

Virtualization/Sandbox Evasion

credential_access stealer

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9f6004c8b8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ff7f8b5053.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b5535807be.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c07d69c6be.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1436	powershell.exe
7096	powershell.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
6076	chrome.exe
4816	chrome.exe
6796	msedge.exe
4856	chrome.exe
3420	firefox.exe
208	msedge.exe
3880	firefox.exe
6096	chrome.exe

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9f6004c8b8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ff7f8b5053.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b5535807be.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b5535807be.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c07d69c6be.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c07d69c6be.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9f6004c8b8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ff7f8b5053.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	skotes.exe

Executes dropped EXE 11 IoCs

pid	Process
5016	skotes.exe
556	skotes.exe
2616	knotc.exe
4004	knotc.exe
4400	b5535807be.exe
5828	9f6004c8b8.exe
1132	ee6f71b39f.exe
6524	c07d69c6be.exe
3880	ff7f8b5053.exe
7056	skotes.exe
4744	skotes.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	b5535807be.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	9f6004c8b8.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	c07d69c6be.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	ff7f8b5053.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	skotes.exe

Loads dropped DLL 39 IoCs

pid	Process
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe
4004	knotc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c07d69c6be.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c07d69c6be.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b5535807be.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009570001\\b5535807be.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9f6004c8b8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009571001\\9f6004c8b8.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ee6f71b39f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009572001\\ee6f71b39f.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c07d69c6be.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009573001\\c07d69c6be.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\TbCJeEDQlFGiVIR.ps1\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
243	api.ipify.org
196	api.ipify.org
197	api.ipify.org
205	api.ipify.org
207	api.ipify.org
232	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000a000000023d1d-1792.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3108	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
1520	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe
5016	skotes.exe
556	skotes.exe
4004	knotc.exe
4400	b5535807be.exe
5828	9f6004c8b8.exe
6524	c07d69c6be.exe
3880	ff7f8b5053.exe
7056	skotes.exe
4744	skotes.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0007000000023c98-40.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c07d69c6be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f6004c8b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff7f8b5053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5535807be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee6f71b39f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 11 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
6548	ipconfig.exe
5172	ipconfig.exe
2084	ipconfig.exe
6368	ipconfig.exe
5432	ipconfig.exe
2788	ipconfig.exe
5332	ipconfig.exe
6184	ipconfig.exe
5772	ipconfig.exe
6316	ipconfig.exe
4440	ipconfig.exe

Gathers system information 1 TTPs 10 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
312	systeminfo.exe
7056	systeminfo.exe
2812	systeminfo.exe
5596	systeminfo.exe
6624	systeminfo.exe
6584	systeminfo.exe
5952	systeminfo.exe
5484	systeminfo.exe
2752	systeminfo.exe
7120	systeminfo.exe

Kills process with taskkill 35 IoCs

pid	Process
5432	taskkill.exe
1004	taskkill.exe
6012	taskkill.exe
3164	taskkill.exe
2800	taskkill.exe
752	taskkill.exe
840	taskkill.exe
6004	taskkill.exe
6148	taskkill.exe
5984	taskkill.exe
6856	taskkill.exe
884	taskkill.exe
5572	taskkill.exe
6188	taskkill.exe
5468	taskkill.exe
4692	taskkill.exe
5624	taskkill.exe
5036	taskkill.exe
6024	taskkill.exe
4972	taskkill.exe
5136	taskkill.exe
6848	taskkill.exe
804	taskkill.exe
5844	taskkill.exe
1520	taskkill.exe
6936	taskkill.exe
1520	taskkill.exe
7088	taskkill.exe
5272	taskkill.exe
6084	taskkill.exe
4356	taskkill.exe
6568	taskkill.exe
2264	taskkill.exe
5348	taskkill.exe
6588	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133771737201946475"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1520	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe
1520	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe
5016	skotes.exe
5016	skotes.exe
556	skotes.exe
556	skotes.exe
4400	b5535807be.exe
4400	b5535807be.exe
5440	msedge.exe
5440	msedge.exe
4856	chrome.exe
4856	chrome.exe
5828	9f6004c8b8.exe
5828	9f6004c8b8.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
6524	c07d69c6be.exe
6524	c07d69c6be.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
6524	c07d69c6be.exe
6524	c07d69c6be.exe
6524	c07d69c6be.exe
3880	ff7f8b5053.exe
3880	ff7f8b5053.exe
3880	ff7f8b5053.exe
3880	ff7f8b5053.exe
3880	ff7f8b5053.exe
3880	ff7f8b5053.exe
3880	ff7f8b5053.exe
3880	ff7f8b5053.exe
3880	ff7f8b5053.exe
3880	ff7f8b5053.exe
7096	powershell.exe
7096	powershell.exe
7096	powershell.exe
7056	skotes.exe
7056	skotes.exe
4744	skotes.exe
4744	skotes.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	taskkill.exe
Token: SeDebugPrivilege	3164	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeDebugPrivilege	3880	firefox.exe
Token: SeDebugPrivilege	3880	firefox.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeDebugPrivilege	4356	taskkill.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeDebugPrivilege	5844	taskkill.exe
Token: SeDebugPrivilege	884	taskkill.exe
Token: SeDebugPrivilege	6004	taskkill.exe
Token: SeDebugPrivilege	6024	taskkill.exe
Token: SeDebugPrivilege	2800	taskkill.exe
Token: SeDebugPrivilege	6568	taskkill.exe
Token: SeDebugPrivilege	6636	firefox.exe
Token: SeDebugPrivilege	6636	firefox.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	6524	c07d69c6be.exe
Token: SeDebugPrivilege	3108	tasklist.exe
Token: SeDebugPrivilege	7088	taskkill.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	6848	taskkill.exe
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeDebugPrivilege	804	taskkill.exe
Token: SeDebugPrivilege	5432	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	6148	taskkill.exe
Token: SeDebugPrivilege	752	taskkill.exe
Token: SeDebugPrivilege	1004	taskkill.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeDebugPrivilege	5348	taskkill.exe
Token: SeDebugPrivilege	5272	taskkill.exe
Token: SeDebugPrivilege	4692	taskkill.exe
Token: SeDebugPrivilege	5624	taskkill.exe
Token: SeDebugPrivilege	6084	taskkill.exe
Token: SeDebugPrivilege	6012	taskkill.exe
Token: SeDebugPrivilege	6856	taskkill.exe
Token: SeDebugPrivilege	5572	taskkill.exe
Token: SeDebugPrivilege	6188	taskkill.exe
Token: SeDebugPrivilege	5468	taskkill.exe
Token: SeDebugPrivilege	6936	taskkill.exe
Token: SeDebugPrivilege	6588	taskkill.exe
Token: SeDebugPrivilege	7096	powershell.exe
Token: SeDebugPrivilege	6636	firefox.exe
Token: SeDebugPrivilege	6636	firefox.exe
Token: SeDebugPrivilege	6636	firefox.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
4856	chrome.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
6636	firefox.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe
1132	ee6f71b39f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3880	firefox.exe
6636	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 5016	1520	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe	83
PID 1520 wrote to memory of 5016	1520	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe	83
PID 1520 wrote to memory of 5016	1520	621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe	83
PID 5016 wrote to memory of 2616	5016	skotes.exe	95
PID 5016 wrote to memory of 2616	5016	skotes.exe	95
PID 2616 wrote to memory of 4004	2616	knotc.exe	96
PID 2616 wrote to memory of 4004	2616	knotc.exe	96
PID 4004 wrote to memory of 736	4004	knotc.exe	97
PID 4004 wrote to memory of 736	4004	knotc.exe	97
PID 5016 wrote to memory of 4400	5016	skotes.exe	103
PID 5016 wrote to memory of 4400	5016	skotes.exe	103
PID 5016 wrote to memory of 4400	5016	skotes.exe	103
PID 4004 wrote to memory of 1680	4004	knotc.exe	104
PID 4004 wrote to memory of 1680	4004	knotc.exe	104
PID 4004 wrote to memory of 2160	4004	knotc.exe	106
PID 4004 wrote to memory of 2160	4004	knotc.exe	106
PID 4004 wrote to memory of 4972	4004	knotc.exe	107
PID 4004 wrote to memory of 4972	4004	knotc.exe	107
PID 4004 wrote to memory of 1220	4004	knotc.exe	109
PID 4004 wrote to memory of 1220	4004	knotc.exe	109
PID 2160 wrote to memory of 840	2160	cmd.exe	112
PID 2160 wrote to memory of 840	2160	cmd.exe	112
PID 1220 wrote to memory of 3164	1220	cmd.exe	113
PID 1220 wrote to memory of 3164	1220	cmd.exe	113
PID 4972 wrote to memory of 5036	4972	cmd.exe	114
PID 4972 wrote to memory of 5036	4972	cmd.exe	114
PID 4004 wrote to memory of 4856	4004	knotc.exe	116
PID 4004 wrote to memory of 4856	4004	knotc.exe	116
PID 4856 wrote to memory of 2660	4856	chrome.exe	117
PID 4856 wrote to memory of 2660	4856	chrome.exe	117
PID 4004 wrote to memory of 208	4004	knotc.exe	118
PID 4004 wrote to memory of 208	4004	knotc.exe	118
PID 4004 wrote to memory of 3420	4004	knotc.exe	119
PID 4004 wrote to memory of 3420	4004	knotc.exe	119
PID 3420 wrote to memory of 3880	3420	firefox.exe	120
PID 3420 wrote to memory of 3880	3420	firefox.exe	120
PID 3420 wrote to memory of 3880	3420	firefox.exe	120
PID 3420 wrote to memory of 3880	3420	firefox.exe	120
PID 3420 wrote to memory of 3880	3420	firefox.exe	120
PID 3420 wrote to memory of 3880	3420	firefox.exe	120
PID 3420 wrote to memory of 3880	3420	firefox.exe	120
PID 3420 wrote to memory of 3880	3420	firefox.exe	120
PID 3420 wrote to memory of 3880	3420	firefox.exe	120
PID 3420 wrote to memory of 3880	3420	firefox.exe	120
PID 3420 wrote to memory of 3880	3420	firefox.exe	120
PID 208 wrote to memory of 4520	208	msedge.exe	121
PID 208 wrote to memory of 4520	208	msedge.exe	121
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122
PID 3880 wrote to memory of 5140	3880	firefox.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe
"C:\Users\Admin\AppData\Local\Temp\621f802e96fdcfa03c497469c663892b78df2f85afac928f716a5d0662d01273.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\1009551001\knotc.exe
    "C:\Users\Admin\AppData\Local\Temp\1009551001\knotc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\1009551001\knotc.exe
      "C:\Users\Admin\AppData\Local\Temp\1009551001\knotc.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:4004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:1680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2160
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4972
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1220
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3164
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session --remote-debugging-port=8860 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
        5⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4856
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7afdcc40,0x7ffc7afdcc4c,0x7ffc7afdcc58
        6⤵
        
        PID:2660
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2228,i,10724117631630837502,11670014537298591548,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2056 /prefetch:2
        6⤵
        
        PID:5336
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=1808,i,10724117631630837502,11670014537298591548,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2324 /prefetch:3
        6⤵
        
        PID:5344
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=2060,i,10724117631630837502,11670014537298591548,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2428 /prefetch:8
        6⤵
        
        PID:5352
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8860 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3736,i,10724117631630837502,11670014537298591548,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3784 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:6076
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8860 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3772,i,10724117631630837502,11670014537298591548,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3844 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:6096
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8860 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4488,i,10724117631630837502,11670014537298591548,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4512 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4816
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=4836,i,10724117631630837502,11670014537298591548,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4588 /prefetch:8
        6⤵
        
        PID:2824
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=4916,i,10724117631630837502,11670014537298591548,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4864 /prefetch:8
        6⤵
        
        PID:4008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session --remote-debugging-port=8964 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
        5⤵
        Uses browser remote debugging
        Suspicious use of WriteProcessMemory
        
        PID:208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc7acd46f8,0x7ffc7acd4708,0x7ffc7acd4718
        6⤵
        
        PID:4520
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1480,18363316493492737259,12930762873896550758,131072 --disable-features=PaintHolding --headless=new --headless --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1488 /prefetch:2
        6⤵
        
        PID:5360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1480,18363316493492737259,12930762873896550758,131072 --disable-features=PaintHolding --lang=en-US --service-sandbox-type=none --use-gl=swiftshader-webgl --headless --mojo-platform-channel-handle=1888 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5440
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=8964 --allow-pre-commit-input --field-trial-handle=1480,18363316493492737259,12930762873896550758,131072 --disable-features=PaintHolding --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1976 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:6796
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --restore-last-session --remote-debugging-port=8108 --remote-allow-origins=* --headless=new --user-data-dir=C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles
        5⤵
        Uses browser remote debugging
        Suspicious use of WriteProcessMemory
        
        PID:3420
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --restore-last-session --remote-debugging-port=8108 --remote-allow-origins=* --headless=new --user-data-dir=C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles
        6⤵
        Uses browser remote debugging
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7f1b237-20a6-4710-8460-de9f5f49b5c6} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" gpu
        7⤵
        
        PID:5140
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2484 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ac9489d-9c71-413e-a46b-ff20aa222430} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" socket
        7⤵
        
        PID:5700
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3272 -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 3256 -prefsLen 28292 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d26e103-4b02-47cc-b09f-6c6e9e89226f} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" tab
        7⤵
        
        PID:6068
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3616 -childID 2 -isForBrowser -prefsHandle 3696 -prefMapHandle 3692 -prefsLen 34809 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b3acb73-67b9-4ec9-9016-651e34a5a90d} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" tab
        7⤵
        
        PID:816
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3680 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4304 -prefMapHandle 4312 -prefsLen 34809 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98d173d6-48de-4922-9fc4-909dab5d3f9c} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" utility
        7⤵
        Checks processor information in registry
        
        PID:5992
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5180 -childID 3 -isForBrowser -prefsHandle 5160 -prefMapHandle 5172 -prefsLen 32517 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f0d86b7-5c95-4034-9c91-f09106fe3925} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" tab
        7⤵
        
        PID:6812
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5308 -childID 4 -isForBrowser -prefsHandle 5320 -prefMapHandle 5324 -prefsLen 32517 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5436030-1a0e-4cb8-8213-b1d23da27097} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" tab
        7⤵
        
        PID:6824
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 5 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 32517 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6811ab85-1df0-470d-a306-473bd88eb57e} 3880 "\\.\pipe\gecko-crash-server-pipe.3880" tab
        7⤵
        
        PID:6836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        5⤵
        
        PID:5564
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        5⤵
        
        PID:5604
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        5⤵
        
        PID:5608
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command " Add-MpPreference -ExclusionExtension '.ps1', '.tmp', '.py' Add-MpPreference -ExclusionPath \"$env:TEMP\", \"$env:APPDATA\" "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:6024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:6396
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        5⤵
        
        PID:6456
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig
        6⤵
        Gathers network information
        
        PID:2084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        5⤵
        
        PID:5076
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:6368
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:6848
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:7056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:2208
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        5⤵
        
        PID:5032
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:5432
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:5212
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:2812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        5⤵
        
        PID:1508
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig
        6⤵
        Gathers network information
        
        PID:2788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        5⤵
        
        PID:5264
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:5332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:5980
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:5484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:6884
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:5596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        5⤵
        
        PID:2356
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig
        6⤵
        Gathers network information
        
        PID:6184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        5⤵
        
        PID:6180
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:6548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:6644
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:6624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:6964
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:6584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        5⤵
        
        PID:5132
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig
        6⤵
        Gathers network information
        
        PID:5772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        5⤵
        
        PID:3624
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:6316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:4720
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:5952
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im brave.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7088
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im chrome.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im msedge.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5136
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im opera.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6848
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im vivaldi.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im yandex.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:804
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im chromium.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5432
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im epic.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im waterfox.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6148
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im palemoon.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:752
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im basilisk.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im iexplore.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5984
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im javaw.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5348
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im Minecraft.Windows.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5272
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im LeagueClient.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im VALORANT-Win64-Shipping.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5624
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im EpicGamesLauncher.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6084
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im Steam.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6012
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im Growtopia.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6856
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im Battle.net.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5572
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im UbisoftConnect.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6188
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im SocialClubHelper.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5468
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im GalaxyClient.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6936
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im EADesktop.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:3756
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:2752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        5⤵
        
        PID:5776
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig
        6⤵
        Gathers network information
        
        PID:5172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        5⤵
        
        PID:6320
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:4440
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:6224
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:7120
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:ProgramData\edge\Updater\Get-Clipboard.ps1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:7096
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ml4pb5wx\ml4pb5wx.cmdline"
        6⤵
        
        PID:7052
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA071.tmp" "c:\Users\Admin\AppData\Local\Temp\ml4pb5wx\CSC39611B924EF4B748F3CCC28FE92629.TMP"
        7⤵
        
        PID:3944
- - C:\Users\Admin\AppData\Local\Temp\1009570001\b5535807be.exe
    "C:\Users\Admin\AppData\Local\Temp\1009570001\b5535807be.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4400
- - C:\Users\Admin\AppData\Local\Temp\1009571001\9f6004c8b8.exe
    "C:\Users\Admin\AppData\Local\Temp\1009571001\9f6004c8b8.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5828
- - C:\Users\Admin\AppData\Local\Temp\1009572001\ee6f71b39f.exe
    "C:\Users\Admin\AppData\Local\Temp\1009572001\ee6f71b39f.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1132
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6004
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2800
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:6616
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:6636
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 24088 -prefMapSize 246093 -appDir "C:\Program Files\Mozilla Firefox\browser" - {355a37c6-9833-4cee-acbe-d8539cfadb49} 6636 "\\.\pipe\gecko-crash-server-pipe.6636" gpu
        6⤵
        
        PID:4420
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2388 -parentBuildID 20240401114208 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 25008 -prefMapSize 246093 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8670a87c-31c3-4fc3-a52c-ddd4d445d5b1} 6636 "\\.\pipe\gecko-crash-server-pipe.6636" socket
        6⤵
        
        PID:6408
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2812 -childID 1 -isForBrowser -prefsHandle 3204 -prefMapHandle 3032 -prefsLen 22858 -prefMapSize 246093 -jsInitHandle 1064 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c117bc2-4d3e-4659-b0d5-cdb6f2220ca5} 6636 "\\.\pipe\gecko-crash-server-pipe.6636" tab
        6⤵
        
        PID:3468
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4008 -childID 2 -isForBrowser -prefsHandle 3996 -prefMapHandle 3084 -prefsLen 29442 -prefMapSize 246093 -jsInitHandle 1064 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adf8a76f-e104-423f-bcb0-d5a84a9ed72e} 6636 "\\.\pipe\gecko-crash-server-pipe.6636" tab
        6⤵
        
        PID:5820
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4708 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4720 -prefMapHandle 4592 -prefsLen 29442 -prefMapSize 246093 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d73e72a-9ef2-4be4-aa3d-23a9274ef744} 6636 "\\.\pipe\gecko-crash-server-pipe.6636" utility
        6⤵
        Checks processor information in registry
        
        PID:1216
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4944 -childID 3 -isForBrowser -prefsHandle 4940 -prefMapHandle 4936 -prefsLen 27151 -prefMapSize 246093 -jsInitHandle 1064 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97a00c71-9232-458b-85c7-71488ede50fb} 6636 "\\.\pipe\gecko-crash-server-pipe.6636" tab
        6⤵
        
        PID:6364
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5080 -childID 4 -isForBrowser -prefsHandle 5088 -prefMapHandle 5092 -prefsLen 27151 -prefMapSize 246093 -jsInitHandle 1064 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {604a0ca4-09c6-457e-85a3-ede546f124f6} 6636 "\\.\pipe\gecko-crash-server-pipe.6636" tab
        6⤵
        
        PID:7136
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 5 -isForBrowser -prefsHandle 5292 -prefMapHandle 5296 -prefsLen 27151 -prefMapSize 246093 -jsInitHandle 1064 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87199e2b-4616-4092-9a37-e0c6c0c0db30} 6636 "\\.\pipe\gecko-crash-server-pipe.6636" tab
        6⤵
        
        PID:3432
- - C:\Users\Admin\AppData\Local\Temp\1009573001\c07d69c6be.exe
    "C:\Users\Admin\AppData\Local\Temp\1009573001\c07d69c6be.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Windows security modification
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6524
- - C:\Users\Admin\AppData\Local\Temp\1009574001\ff7f8b5053.exe
    "C:\Users\Admin\AppData\Local\Temp\1009574001\ff7f8b5053.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3880

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5560

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:32

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4000

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:7056

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion