discordrat | 1d184c635a032625f10639ec3458a6f8d0a36a6a82078a11b820924f39056080

Resubmissions

12-12-2024 19:55

241212-ym8klsxnfp 10

12-12-2024 19:20

12-12-2024 19:16

12-12-2024 19:16

12-12-2024 18:49

12-12-2024 18:46

12-12-2024 18:39

12-12-2024 18:27

Analysis

max time kernel
315s
max time network
319s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mta.exe
Size

98KB
MD5

778dce14368e8b1105544c43ce09d2f1
SHA1

81c7cc17d48b8c5e6e5b9cc1efc8bbae1646dcb0
SHA256

1d184c635a032625f10639ec3458a6f8d0a36a6a82078a11b820924f39056080
SHA512

31a517a024726bef90c60c05173852de117e27960e981ec92456e6a3e4c0b6ac50437b8bfd2ced7afbad2a81c3e00a4c9bd5622af2236f3ae37856d6fd9d4aab
SSDEEP

1536:Vic45PApy/vpjAnT9ZqzY4r5VVZDAcE3VCQfwbJ6Pr5+NzxCxoKV6+UyNV:AxApgR8T9EE4r5n8rwbJ6Pr5+zNyj

Score

10^/10

discordrat persistence ransomware rat rootkit stealer

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/1260-1-0x000001D469F80000-0x000001D469F9C000-memory.dmp	disable_win_def

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 19 IoCs

Web Service

T1102

flow	ioc
83	discord.com
7	discord.com
56	discord.com
65	discord.com
64	discord.com
84	discord.com
19	discord.com
24	discord.com
25	discord.com
79	discord.com
81	discord.com
82	discord.com
58	discord.com
62	discord.com
63	discord.com
80	discord.com
8	discord.com
52	discord.com
54	discord.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp143F.tmp.png"	mta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp7319.tmp.png"	mta.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	mta.exe
Token: 33	1012	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1012	AUDIODG.EXE
Token: SeDebugPrivilege	4916	firefox.exe
Token: SeDebugPrivilege	4916	firefox.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
1260	mta.exe
1020	notepad.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4916	3696	firefox.exe	129
PID 3696 wrote to memory of 4916	3696	firefox.exe	129
PID 3696 wrote to memory of 4916	3696	firefox.exe	129
PID 3696 wrote to memory of 4916	3696	firefox.exe	129
PID 3696 wrote to memory of 4916	3696	firefox.exe	129
PID 3696 wrote to memory of 4916	3696	firefox.exe	129
PID 3696 wrote to memory of 4916	3696	firefox.exe	129
PID 3696 wrote to memory of 4916	3696	firefox.exe	129
PID 3696 wrote to memory of 4916	3696	firefox.exe	129
PID 3696 wrote to memory of 4916	3696	firefox.exe	129
PID 3696 wrote to memory of 4916	3696	firefox.exe	129
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 4252	4916	firefox.exe	131
PID 4916 wrote to memory of 1836	4916	firefox.exe	132
PID 4916 wrote to memory of 1836	4916	firefox.exe	132
PID 4916 wrote to memory of 1836	4916	firefox.exe	132
PID 4916 wrote to memory of 1836	4916	firefox.exe	132
PID 4916 wrote to memory of 1836	4916	firefox.exe	132
PID 4916 wrote to memory of 1836	4916	firefox.exe	132
PID 4916 wrote to memory of 1836	4916	firefox.exe	132
PID 4916 wrote to memory of 1836	4916	firefox.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\mta.exe
"C:\Users\Admin\AppData\Local\Temp\mta.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1260

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x294 0x530
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1020

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e98a8269-2261-4473-8e13-75bb418a2047} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" gpu
    3⤵
    PID:4252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2424 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {233741e0-8960-4de3-b059-ca23c6da0034} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" socket
    3⤵
    - Checks processor information in registry
    PID:1836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2936 -childID 1 -isForBrowser -prefsHandle 2952 -prefMapHandle 1560 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b4fe0ed-2951-41de-8f5b-dcff022ff28b} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4144 -childID 2 -isForBrowser -prefsHandle 4248 -prefMapHandle 4244 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96a8de5c-a59c-4c0b-82fb-e86205714c2e} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:1388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4816 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4832 -prefMapHandle 4828 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af263e8a-e3e9-4849-85ee-804daa1a3181} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" utility
    3⤵
    - Checks processor information in registry
    PID:2680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5212 -childID 3 -isForBrowser -prefsHandle 5336 -prefMapHandle 5332 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {790ee42f-89ce-4276-a786-838af9732dd5} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 4 -isForBrowser -prefsHandle 5496 -prefMapHandle 5320 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2ce61e4-1f21-4c23-989b-48b50724ef54} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 5 -isForBrowser -prefsHandle 2888 -prefMapHandle 3336 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {deee4b8e-6bfa-46c6-b198-3cb163d5c561} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3620 -childID 6 -isForBrowser -prefsHandle 4476 -prefMapHandle 4468 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97848375-d257-44e2-a568-93eb8900c1c9} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5496 -childID 7 -isForBrowser -prefsHandle 5516 -prefMapHandle 5380 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8fe7626-ff5f-448d-a896-37b8605272c1} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:4448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6160 -parentBuildID 20240401114208 -prefsHandle 6428 -prefMapHandle 6164 -prefsLen 29357 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a399e274-e8ca-48dd-93b9-ada82b76e9e3} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" rdd
    3⤵
    PID:1084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6172 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6440 -prefMapHandle 6436 -prefsLen 29357 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c482653-1ef8-4a9e-b8c0-f6f16e1585a1} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" utility
    3⤵
    - Checks processor information in registry
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7020 -childID 8 -isForBrowser -prefsHandle 5692 -prefMapHandle 5696 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cfe1d73-4fd1-4fdc-b41a-05fc3c776198} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6720 -childID 9 -isForBrowser -prefsHandle 5724 -prefMapHandle 5708 -prefsLen 28059 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f2ff6d3-6be5-4046-9f5a-55841e9fbdf7} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7352 -childID 10 -isForBrowser -prefsHandle 5380 -prefMapHandle 5708 -prefsLen 28059 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9b5048b-ab8f-4c42-8cd1-33bb70bfa4f1} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 11 -isForBrowser -prefsHandle 7472 -prefMapHandle 7480 -prefsLen 28059 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d2ad386-f459-4185-9d66-caf6063152c5} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5664 -childID 12 -isForBrowser -prefsHandle 7804 -prefMapHandle 7800 -prefsLen 28059 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf1873ee-8565-477e-aeb2-660ddfb59fc1} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4544 -childID 13 -isForBrowser -prefsHandle 4516 -prefMapHandle 6744 -prefsLen 28059 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6299830f-260b-4ae2-9dcf-4c2ba73074a2} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:3292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6056 -childID 14 -isForBrowser -prefsHandle 6824 -prefMapHandle 3616 -prefsLen 28059 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d9b99b5-f391-434a-815f-e8369c6efc68} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:6440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7428 -childID 15 -isForBrowser -prefsHandle 7528 -prefMapHandle 5692 -prefsLen 28059 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfdd7227-8cf3-40ca-874c-a5023513d90b} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:3228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7380 -childID 16 -isForBrowser -prefsHandle 5808 -prefMapHandle 5804 -prefsLen 28059 -prefMapSize 244658 -jsInitHandle 1200 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8227092c-29bf-4328-8bb1-0c9c5c014c7c} 4916 "\\.\pipe\gecko-crash-server-pipe.4916" tab
    3⤵
    PID:5496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control