amadey | 5a67aaf20520d4c44b4dc31004ca6aeb05a96e6052e147e72a51e4b2a90b0fbb

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	4T069G.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	4T069G.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b8aad32295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	4T069G.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	4T069G.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	4T069G.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b8aad32295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b8aad32295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b8aad32295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b8aad32295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	4T069G.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	2dc69c7a30.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs

Query Registry

Virtualization/Sandbox Evasion

credential_access stealer

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1q87o2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4T069G.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2dc69c7a30.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2L3031.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3Q87E.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7cdb4a3066.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0ea02de2d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b8aad32295.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2924	powershell.exe
6428	powershell.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 16 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
6268	chrome.exe
7804	firefox.exe
6780	msedge.exe
5508	firefox.exe
2864	chrome.exe
6488	chrome.exe
4852	chrome.exe
7636	firefox.exe
5352	firefox.exe
6524	chrome.exe
6540	chrome.exe
7672	firefox.exe
5820	firefox.exe
5832	chrome.exe
5828	msedge.exe
6480	chrome.exe

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2L3031.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7cdb4a3066.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0ea02de2d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4T069G.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2dc69c7a30.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2dc69c7a30.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3Q87E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4T069G.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7cdb4a3066.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b8aad32295.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1q87o2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2L3031.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3Q87E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0ea02de2d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b8aad32295.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1q87o2.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	1q87o2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	skotes.exe

Executes dropped EXE 17 IoCs

pid	Process
2980	A8k29.exe
3660	u4m08.exe
4536	1q87o2.exe
1680	skotes.exe
1168	2L3031.exe
3604	skotes.exe
1436	3Q87E.exe
3204	4T069G.exe
1328	knotc.exe
3032	knotc.exe
4576	2dc69c7a30.exe
3640	7cdb4a3066.exe
5660	0ea02de2d3.exe
5688	d23e612fbe.exe
4704	b8aad32295.exe
7756	skotes.exe
5736	skotes.exe

Identifies Wine through registry keys 2 TTPs 12 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	1q87o2.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	3Q87E.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	2dc69c7a30.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	7cdb4a3066.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	b8aad32295.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	2L3031.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	4T069G.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	0ea02de2d3.exe

Loads dropped DLL 39 IoCs

pid	Process
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe
3032	knotc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	4T069G.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	4T069G.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	b8aad32295.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	u4m08.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7cdb4a3066.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009575001\\7cdb4a3066.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0ea02de2d3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009576001\\0ea02de2d3.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d23e612fbe.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009577001\\d23e612fbe.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b8aad32295.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009578001\\b8aad32295.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Roaming\\UunhiITVcMjByEa.ps1\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5a67aaf20520d4c44b4dc31004ca6aeb05a96e6052e147e72a51e4b2a90b0fbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	A8k29.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
257	api.ipify.org
263	api.ipify.org
249	api.ipify.org
250	api.ipify.org
253	api.ipify.org
255	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000d000000023cd0-1550.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5960	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

pid	Process
4536	1q87o2.exe
1680	skotes.exe
1168	2L3031.exe
3604	skotes.exe
1436	3Q87E.exe
3204	4T069G.exe
3032	knotc.exe
4576	2dc69c7a30.exe
3640	7cdb4a3066.exe
5660	0ea02de2d3.exe
4704	b8aad32295.exe
7756	skotes.exe
5736	skotes.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	1q87o2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000a000000023c04-66.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3Q87E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A8k29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1q87o2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2L3031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ea02de2d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a67aaf20520d4c44b4dc31004ca6aeb05a96e6052e147e72a51e4b2a90b0fbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u4m08.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8aad32295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2dc69c7a30.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cdb4a3066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d23e612fbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4T069G.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 11 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
6368	ipconfig.exe
2972	ipconfig.exe
7392	ipconfig.exe
6056	ipconfig.exe
7208	ipconfig.exe
5824	ipconfig.exe
2552	ipconfig.exe
7256	ipconfig.exe
4380	ipconfig.exe
6816	ipconfig.exe
3464	ipconfig.exe

Gathers system information 1 TTPs 10 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
3104	systeminfo.exe
6644	systeminfo.exe
6304	systeminfo.exe
5508	systeminfo.exe
5128	systeminfo.exe
5636	systeminfo.exe
7584	systeminfo.exe
7424	systeminfo.exe
8092	systeminfo.exe
6968	systeminfo.exe

Kills process with taskkill 38 IoCs

pid	Process
4956	taskkill.exe
4392	taskkill.exe
8072	taskkill.exe
3596	taskkill.exe
5452	taskkill.exe
7996	taskkill.exe
6560	taskkill.exe
6104	taskkill.exe
3344	taskkill.exe
1876	taskkill.exe
4020	taskkill.exe
3916	taskkill.exe
2336	taskkill.exe
6844	taskkill.exe
1564	taskkill.exe
6312	taskkill.exe
4416	taskkill.exe
6164	taskkill.exe
6596	taskkill.exe
1128	taskkill.exe
5124	taskkill.exe
5484	taskkill.exe
4468	taskkill.exe
2732	taskkill.exe
5628	taskkill.exe
7524	taskkill.exe
5456	taskkill.exe
5800	taskkill.exe
2892	taskkill.exe
6184	taskkill.exe
5444	taskkill.exe
5036	taskkill.exe
1536	taskkill.exe
5476	taskkill.exe
5736	taskkill.exe
7844	taskkill.exe
4220	taskkill.exe
7332	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133771744478979206"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4536	1q87o2.exe
4536	1q87o2.exe
1680	skotes.exe
1680	skotes.exe
1168	2L3031.exe
1168	2L3031.exe
3604	skotes.exe
3604	skotes.exe
1436	3Q87E.exe
1436	3Q87E.exe
3204	4T069G.exe
3204	4T069G.exe
3204	4T069G.exe
3204	4T069G.exe
4576	2dc69c7a30.exe
4576	2dc69c7a30.exe
4576	2dc69c7a30.exe
4576	2dc69c7a30.exe
4576	2dc69c7a30.exe
4576	2dc69c7a30.exe
4576	2dc69c7a30.exe
4576	2dc69c7a30.exe
4576	2dc69c7a30.exe
4576	2dc69c7a30.exe
3640	7cdb4a3066.exe
3640	7cdb4a3066.exe
5660	0ea02de2d3.exe
5660	0ea02de2d3.exe
7180	msedge.exe
7180	msedge.exe
5832	chrome.exe
5832	chrome.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
4704	b8aad32295.exe
4704	b8aad32295.exe
4704	b8aad32295.exe
4704	b8aad32295.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
2864	chrome.exe
2864	chrome.exe
2924	powershell.exe
2924	powershell.exe
7756	skotes.exe
7756	skotes.exe
6428	powershell.exe
6428	powershell.exe
5736	skotes.exe
5736	skotes.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3204	4T069G.exe
Token: SeDebugPrivilege	5456	taskkill.exe
Token: SeDebugPrivilege	5484	taskkill.exe
Token: SeDebugPrivilege	5476	taskkill.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeDebugPrivilege	7804	firefox.exe
Token: SeDebugPrivilege	7804	firefox.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeDebugPrivilege	5800	taskkill.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeDebugPrivilege	7996	taskkill.exe
Token: SeDebugPrivilege	8072	taskkill.exe
Token: SeDebugPrivilege	3344	taskkill.exe
Token: SeDebugPrivilege	1876	taskkill.exe
Token: SeDebugPrivilege	4416	taskkill.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	4956	taskkill.exe
Token: SeDebugPrivilege	4704	b8aad32295.exe
Token: SeDebugPrivilege	1640	firefox.exe
Token: SeDebugPrivilege	1640	firefox.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeDebugPrivilege	6164	taskkill.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeDebugPrivilege	6596	taskkill.exe
Token: SeDebugPrivilege	7636	firefox.exe
Token: SeDebugPrivilege	7636	firefox.exe
Token: SeDebugPrivilege	5736	taskkill.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	5960	tasklist.exe
Token: SeDebugPrivilege	1128	taskkill.exe
Token: SeDebugPrivilege	3596	taskkill.exe
Token: SeDebugPrivilege	5124	taskkill.exe
Token: SeDebugPrivilege	6560	taskkill.exe
Token: SeDebugPrivilege	6844	taskkill.exe
Token: SeDebugPrivilege	7844	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	1564	taskkill.exe
Token: SeDebugPrivilege	6184	taskkill.exe
Token: SeDebugPrivilege	4020	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	4220	taskkill.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	7332	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe
Token: SeDebugPrivilege	5444	taskkill.exe
Token: SeDebugPrivilege	2336	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4536	1q87o2.exe
5832	chrome.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
2864	chrome.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
7804	firefox.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
5688	d23e612fbe.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe
7636	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
7804	firefox.exe
1640	firefox.exe
7636	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 2980	4012	5a67aaf20520d4c44b4dc31004ca6aeb05a96e6052e147e72a51e4b2a90b0fbb.exe	82
PID 4012 wrote to memory of 2980	4012	5a67aaf20520d4c44b4dc31004ca6aeb05a96e6052e147e72a51e4b2a90b0fbb.exe	82
PID 4012 wrote to memory of 2980	4012	5a67aaf20520d4c44b4dc31004ca6aeb05a96e6052e147e72a51e4b2a90b0fbb.exe	82
PID 2980 wrote to memory of 3660	2980	A8k29.exe	83
PID 2980 wrote to memory of 3660	2980	A8k29.exe	83
PID 2980 wrote to memory of 3660	2980	A8k29.exe	83
PID 3660 wrote to memory of 4536	3660	u4m08.exe	84
PID 3660 wrote to memory of 4536	3660	u4m08.exe	84
PID 3660 wrote to memory of 4536	3660	u4m08.exe	84
PID 4536 wrote to memory of 1680	4536	1q87o2.exe	85
PID 4536 wrote to memory of 1680	4536	1q87o2.exe	85
PID 4536 wrote to memory of 1680	4536	1q87o2.exe	85
PID 3660 wrote to memory of 1168	3660	u4m08.exe	86
PID 3660 wrote to memory of 1168	3660	u4m08.exe	86
PID 3660 wrote to memory of 1168	3660	u4m08.exe	86
PID 2980 wrote to memory of 1436	2980	A8k29.exe	92
PID 2980 wrote to memory of 1436	2980	A8k29.exe	92
PID 2980 wrote to memory of 1436	2980	A8k29.exe	92
PID 4012 wrote to memory of 3204	4012	5a67aaf20520d4c44b4dc31004ca6aeb05a96e6052e147e72a51e4b2a90b0fbb.exe	94
PID 4012 wrote to memory of 3204	4012	5a67aaf20520d4c44b4dc31004ca6aeb05a96e6052e147e72a51e4b2a90b0fbb.exe	94
PID 4012 wrote to memory of 3204	4012	5a67aaf20520d4c44b4dc31004ca6aeb05a96e6052e147e72a51e4b2a90b0fbb.exe	94
PID 1680 wrote to memory of 1328	1680	skotes.exe	97
PID 1680 wrote to memory of 1328	1680	skotes.exe	97
PID 1328 wrote to memory of 3032	1328	knotc.exe	98
PID 1328 wrote to memory of 3032	1328	knotc.exe	98
PID 3032 wrote to memory of 3500	3032	knotc.exe	99
PID 3032 wrote to memory of 3500	3032	knotc.exe	99
PID 1680 wrote to memory of 4576	1680	skotes.exe	101
PID 1680 wrote to memory of 4576	1680	skotes.exe	101
PID 1680 wrote to memory of 4576	1680	skotes.exe	101
PID 1680 wrote to memory of 3640	1680	skotes.exe	102
PID 1680 wrote to memory of 3640	1680	skotes.exe	102
PID 1680 wrote to memory of 3640	1680	skotes.exe	102
PID 3032 wrote to memory of 5272	3032	knotc.exe	103
PID 3032 wrote to memory of 5272	3032	knotc.exe	103
PID 3032 wrote to memory of 5336	3032	knotc.exe	105
PID 3032 wrote to memory of 5336	3032	knotc.exe	105
PID 3032 wrote to memory of 5348	3032	knotc.exe	106
PID 3032 wrote to memory of 5348	3032	knotc.exe	106
PID 3032 wrote to memory of 5356	3032	knotc.exe	107
PID 3032 wrote to memory of 5356	3032	knotc.exe	107
PID 5348 wrote to memory of 5456	5348	cmd.exe	111
PID 5348 wrote to memory of 5456	5348	cmd.exe	111
PID 5356 wrote to memory of 5476	5356	cmd.exe	112
PID 5356 wrote to memory of 5476	5356	cmd.exe	112
PID 5336 wrote to memory of 5484	5336	cmd.exe	113
PID 5336 wrote to memory of 5484	5336	cmd.exe	113
PID 1680 wrote to memory of 5660	1680	skotes.exe	114
PID 1680 wrote to memory of 5660	1680	skotes.exe	114
PID 1680 wrote to memory of 5660	1680	skotes.exe	114
PID 3032 wrote to memory of 5832	3032	knotc.exe	116
PID 3032 wrote to memory of 5832	3032	knotc.exe	116
PID 3032 wrote to memory of 5828	3032	knotc.exe	115
PID 3032 wrote to memory of 5828	3032	knotc.exe	115
PID 3032 wrote to memory of 5820	3032	knotc.exe	117
PID 3032 wrote to memory of 5820	3032	knotc.exe	117
PID 5820 wrote to memory of 7804	5820	firefox.exe	118
PID 5820 wrote to memory of 7804	5820	firefox.exe	118
PID 5820 wrote to memory of 7804	5820	firefox.exe	118
PID 5820 wrote to memory of 7804	5820	firefox.exe	118
PID 5820 wrote to memory of 7804	5820	firefox.exe	118
PID 5820 wrote to memory of 7804	5820	firefox.exe	118
PID 5820 wrote to memory of 7804	5820	firefox.exe	118
PID 5820 wrote to memory of 7804	5820	firefox.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5a67aaf20520d4c44b4dc31004ca6aeb05a96e6052e147e72a51e4b2a90b0fbb.exe
"C:\Users\Admin\AppData\Local\Temp\5a67aaf20520d4c44b4dc31004ca6aeb05a96e6052e147e72a51e4b2a90b0fbb.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\A8k29.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\A8k29.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4m08.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4m08.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1q87o2.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1q87o2.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\1009551001\knotc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009551001\knotc.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\1009551001\knotc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009551001\knotc.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        8⤵
        
        PID:3500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        8⤵
        
        PID:5272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5336
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5348
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5356
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session --remote-debugging-port=8899 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
        8⤵
        Uses browser remote debugging
        
        PID:5828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffc0dac46f8,0x7ffc0dac4708,0x7ffc0dac4718
        9⤵
        
        PID:7780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1524,14591945404468771591,16986671735552970321,131072 --disable-features=PaintHolding --headless=new --headless --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1532 /prefetch:2
        9⤵
        
        PID:7304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,14591945404468771591,16986671735552970321,131072 --disable-features=PaintHolding --lang=en-US --service-sandbox-type=none --use-gl=swiftshader-webgl --headless --mojo-platform-channel-handle=1896 /prefetch:3
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=8899 --allow-pre-commit-input --field-trial-handle=1524,14591945404468771591,16986671735552970321,131072 --disable-features=PaintHolding --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1924 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:6780
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session --remote-debugging-port=8850 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
        8⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5832
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc0d86cc40,0x7ffc0d86cc4c,0x7ffc0d86cc58
        9⤵
        
        PID:7772
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,7716224302749585225,10923235398518375380,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1944 /prefetch:2
        9⤵
        
        PID:7288
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=2192,i,7716224302749585225,10923235398518375380,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2236 /prefetch:3
        9⤵
        
        PID:7264
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=2264,i,7716224302749585225,10923235398518375380,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:8
        9⤵
        
        PID:7220
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8850 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3756,i,7716224302749585225,10923235398518375380,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3768 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:6488
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8850 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3776,i,7716224302749585225,10923235398518375380,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3900 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:6480
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8850 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,7716224302749585225,10923235398518375380,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4520 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:4852
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=4892,i,7716224302749585225,10923235398518375380,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4940 /prefetch:8
        9⤵
        
        PID:3604
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=4040,i,7716224302749585225,10923235398518375380,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4984 /prefetch:8
        9⤵
        
        PID:5912
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --restore-last-session --remote-debugging-port=8664 --remote-allow-origins=* --headless=new --user-data-dir=C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles
        8⤵
        Uses browser remote debugging
        Suspicious use of WriteProcessMemory
        
        PID:5820
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --restore-last-session --remote-debugging-port=8664 --remote-allow-origins=* --headless=new --user-data-dir=C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles
        9⤵
        Uses browser remote debugging
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:7804
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2020 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb1bac71-6202-44e8-a365-ec97c786a9e5} 7804 "\\.\pipe\gecko-crash-server-pipe.7804" gpu
        10⤵
        
        PID:7436
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2528 -parentBuildID 20240401114208 -prefsHandle 2496 -prefMapHandle 2492 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9c46413-7fa9-4242-9fd5-86adecb1f2b4} 7804 "\\.\pipe\gecko-crash-server-pipe.7804" socket
        10⤵
        
        PID:6916
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3352 -childID 1 -isForBrowser -prefsHandle 3408 -prefMapHandle 3116 -prefsLen 28292 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77e77f50-4f14-4331-8520-ba08f1dd60d6} 7804 "\\.\pipe\gecko-crash-server-pipe.7804" tab
        10⤵
        
        PID:3144
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3828 -childID 2 -isForBrowser -prefsHandle 3820 -prefMapHandle 3816 -prefsLen 34809 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bbce89a-2cc0-4bb4-90b2-59ceb35a023b} 7804 "\\.\pipe\gecko-crash-server-pipe.7804" tab
        10⤵
        
        PID:5928
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4632 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4568 -prefMapHandle 4620 -prefsLen 34809 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e65f7251-3b35-49aa-a242-dc87171e9f02} 7804 "\\.\pipe\gecko-crash-server-pipe.7804" utility
        10⤵
        Checks processor information in registry
        
        PID:8148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        8⤵
        
        PID:752
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        8⤵
        
        PID:1136
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        8⤵
        
        PID:5004
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4956
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --restore-last-session --remote-debugging-port=8369 --remote-allow-origins=* --headless=new --user-data-dir=C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles
        8⤵
        Uses browser remote debugging
        
        PID:5508
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --restore-last-session --remote-debugging-port=8369 --remote-allow-origins=* --headless=new --user-data-dir=C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles
        9⤵
        Uses browser remote debugging
        Checks processor information in registry
        
        PID:5352
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session --remote-debugging-port=8975 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
        8⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2864
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x168,0x16c,0x170,0x13c,0x174,0x7ffc0a92cc40,0x7ffc0a92cc4c,0x7ffc0a92cc58
        9⤵
        
        PID:2680
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2064,i,1671868865680682541,3713025021224301896,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2060 /prefetch:2
        9⤵
        
        PID:5652
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=1224,i,1671868865680682541,3713025021224301896,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2160 /prefetch:3
        9⤵
        
        PID:5672
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=2340,i,1671868865680682541,3713025021224301896,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:8
        9⤵
        
        PID:7936
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8975 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3780,i,1671868865680682541,3713025021224301896,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3792 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:6540
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8975 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3796,i,1671868865680682541,3713025021224301896,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3840 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:6524
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8975 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4556,i,1671868865680682541,3713025021224301896,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4528 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:6268
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=4548,i,1671868865680682541,3713025021224301896,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:8
        9⤵
        
        PID:6116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=4512,i,1671868865680682541,3713025021224301896,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4844 /prefetch:8
        9⤵
        
        PID:1564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        8⤵
        
        PID:6704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        8⤵
        
        PID:6836
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6596
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --restore-last-session --remote-debugging-port=8409 --remote-allow-origins=* --headless=new --user-data-dir=C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles
        8⤵
        Uses browser remote debugging
        
        PID:7672
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --restore-last-session --remote-debugging-port=8409 --remote-allow-origins=* --headless=new --user-data-dir=C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles
        9⤵
        Uses browser remote debugging
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:7636
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 23737 -prefMapSize 244710 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f86a15f-16e8-433c-8811-6f180b9ae7b4} 7636 "\\.\pipe\gecko-crash-server-pipe.7636" gpu
        10⤵
        
        PID:7656
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2416 -prefsLen 24657 -prefMapSize 244710 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f90f9183-667e-4e61-87b6-8a50724c6dbc} 7636 "\\.\pipe\gecko-crash-server-pipe.7636" socket
        10⤵
        
        PID:7824
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3076 -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 3092 -prefsLen 28292 -prefMapSize 244710 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {413bc3c9-9da2-47cc-b8ec-bb765797bdfd} 7636 "\\.\pipe\gecko-crash-server-pipe.7636" tab
        10⤵
        
        PID:3604
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4032 -childID 2 -isForBrowser -prefsHandle 4044 -prefMapHandle 4040 -prefsLen 34809 -prefMapSize 244710 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75f09bf5-7135-421e-ba60-1563aab25252} 7636 "\\.\pipe\gecko-crash-server-pipe.7636" tab
        10⤵
        
        PID:7076
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4552 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4596 -prefMapHandle 4584 -prefsLen 34809 -prefMapSize 244710 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ed42aa3-0409-4462-8d66-061be5d5cdc0} 7636 "\\.\pipe\gecko-crash-server-pipe.7636" utility
        10⤵
        Checks processor information in registry
        
        PID:4508
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4980 -childID 3 -isForBrowser -prefsHandle 4928 -prefMapHandle 4948 -prefsLen 32517 -prefMapSize 244710 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7986d53-8f55-4c02-86c7-ec3f3e2bfaeb} 7636 "\\.\pipe\gecko-crash-server-pipe.7636" tab
        10⤵
        
        PID:5800
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -childID 4 -isForBrowser -prefsHandle 5144 -prefMapHandle 5148 -prefsLen 32517 -prefMapSize 244710 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a819e3a-42c7-48ea-9e3d-f5dc5aacdafe} 7636 "\\.\pipe\gecko-crash-server-pipe.7636" tab
        10⤵
        
        PID:5272
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 5 -isForBrowser -prefsHandle 5412 -prefMapHandle 5408 -prefsLen 32517 -prefMapSize 244710 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc1727a9-5db1-4fee-b63e-b4ad99988c05} 7636 "\\.\pipe\gecko-crash-server-pipe.7636" tab
        10⤵
        
        PID:5240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        8⤵
        
        PID:2520
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5736
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command " Add-MpPreference -ExclusionExtension '.ps1', '.tmp', '.py' Add-MpPreference -ExclusionPath \"$env:TEMP\", \"$env:APPDATA\" "
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        8⤵
        
        PID:4264
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        9⤵
        Gathers system information
        
        PID:5636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        8⤵
        
        PID:5676
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        9⤵
        Gathers network information
        
        PID:5824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        8⤵
        
        PID:2380
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        9⤵
        Gathers network information
        
        PID:6368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        8⤵
        
        PID:6348
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        9⤵
        Gathers system information
        
        PID:7584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        8⤵
        
        PID:6268
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        8⤵
        
        PID:7540
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        9⤵
        Gathers network information
        
        PID:2972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        8⤵
        
        PID:5984
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        9⤵
        Gathers system information
        
        PID:7424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        8⤵
        
        PID:7784
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        9⤵
        Gathers network information
        
        PID:7392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        8⤵
        
        PID:7316
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        9⤵
        Gathers network information
        
        PID:2552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        8⤵
        
        PID:7480
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        9⤵
        Gathers system information
        
        PID:3104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        8⤵
        
        PID:8116
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        9⤵
        Gathers system information
        
        PID:8092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        8⤵
        
        PID:7708
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        9⤵
        Gathers network information
        
        PID:7256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        8⤵
        
        PID:1876
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        9⤵
        Gathers network information
        
        PID:4380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        8⤵
        
        PID:1008
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        9⤵
        Gathers system information
        
        PID:6644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        8⤵
        
        PID:7044
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        9⤵
        Gathers system information
        
        PID:6968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        8⤵
        
        PID:7364
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        9⤵
        Gathers network information
        
        PID:6816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        8⤵
        
        PID:6796
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        9⤵
        Gathers network information
        
        PID:3464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        8⤵
        
        PID:1956
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        9⤵
        Gathers system information
        
        PID:5508
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im brave.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im msedge.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5124
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im opera.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6560
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im vivaldi.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6844
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im yandex.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7844
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im chromium.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im epic.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im waterfox.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6184
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im palemoon.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4020
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im basilisk.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im iexplore.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4220
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im javaw.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3916
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im Minecraft.Windows.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7332
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im LeagueClient.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im VALORANT-Win64-Shipping.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im EpicGamesLauncher.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5444
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im Steam.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im Growtopia.exe
        8⤵
        Kills process with taskkill
        
        PID:6312
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im Battle.net.exe
        8⤵
        Kills process with taskkill
        
        PID:5452
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im UbisoftConnect.exe
        8⤵
        Kills process with taskkill
        
        PID:5628
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im SocialClubHelper.exe
        8⤵
        Kills process with taskkill
        
        PID:6104
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im GalaxyClient.exe
        8⤵
        Kills process with taskkill
        
        PID:4392
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im EADesktop.exe
        8⤵
        Kills process with taskkill
        
        PID:7524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        8⤵
        
        PID:2492
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        9⤵
        Gathers system information
        
        PID:5128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        8⤵
        
        PID:4556
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        9⤵
        Gathers network information
        
        PID:6056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        8⤵
        
        PID:6052
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        9⤵
        Gathers network information
        
        PID:7208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        8⤵
        
        PID:3144
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        9⤵
        Gathers system information
        
        PID:6304
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:ProgramData\edge\Updater\Get-Clipboard.ps1
        8⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:6428
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pz2sbz4n\pz2sbz4n.cmdline"
        9⤵
        
        PID:3656
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22EF.tmp" "c:\Users\Admin\AppData\Local\Temp\pz2sbz4n\CSCC74A4A7EB7C74D47B99DBDCF22F81CF.TMP"
        10⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\1009574001\2dc69c7a30.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009574001\2dc69c7a30.exe"
        6⤵
        Enumerates VirtualBox registry keys
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\1009575001\7cdb4a3066.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009575001\7cdb4a3066.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\1009576001\0ea02de2d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009576001\0ea02de2d3.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\1009577001\d23e612fbe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009577001\d23e612fbe.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5688
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5800
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:7996
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:8072
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4416
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4468
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:4764
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244710 -appDir "C:\Program Files\Mozilla Firefox\browser" - {34a1092e-c00b-4a0e-9901-6931db50aeb9} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" gpu
        9⤵
        
        PID:384
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 24600 -prefMapSize 244710 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0283a59e-1685-4216-b9bd-c3aa6a792640} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" socket
        9⤵
        
        PID:3312
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1628 -childID 1 -isForBrowser -prefsHandle 3336 -prefMapHandle 3396 -prefsLen 22652 -prefMapSize 244710 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ab37535-b475-4a2d-95cd-7890473f67e3} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" tab
        9⤵
        
        PID:4236
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4068 -childID 2 -isForBrowser -prefsHandle 4092 -prefMapHandle 4088 -prefsLen 29090 -prefMapSize 244710 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2d4caa6-f8ec-458d-96b7-4cca57696de4} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" tab
        9⤵
        
        PID:5532
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4768 -childID 3 -isForBrowser -prefsHandle 4700 -prefMapHandle 4680 -prefsLen 29197 -prefMapSize 244710 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bedde45d-9c51-4940-8f00-4511dd61deb0} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" tab
        9⤵
        
        PID:7336
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5096 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5108 -prefMapHandle 5104 -prefsLen 29197 -prefMapSize 244710 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f417903-4430-4de8-9b46-17daf9233dee} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" utility
        9⤵
        Checks processor information in registry
        
        PID:5096
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4044 -childID 4 -isForBrowser -prefsHandle 3140 -prefMapHandle 5612 -prefsLen 27132 -prefMapSize 244710 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf9c0d54-a691-4c7e-9658-c8c63400eba7} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" tab
        9⤵
        
        PID:4984
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5828 -childID 5 -isForBrowser -prefsHandle 5836 -prefMapHandle 5840 -prefsLen 27132 -prefMapSize 244710 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {942d0160-40bd-42b2-ab4e-8ba49e6c2b96} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" tab
        9⤵
        
        PID:2896
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6020 -childID 6 -isForBrowser -prefsHandle 6028 -prefMapHandle 6032 -prefsLen 27132 -prefMapSize 244710 -jsInitHandle 928 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51815d80-4c14-43c0-8f50-28a30c399f71} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" tab
        9⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\1009578001\b8aad32295.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1009578001\b8aad32295.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Windows security modification
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2L3031.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2L3031.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1168
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Q87E.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Q87E.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1436
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4T069G.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4T069G.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Windows security modification
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3204

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6996

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5704

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:6420

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:7756

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion