ryuk | 7bac5c10d02534007f1efb371885ae3918d21d394371f92d4e6455b58b4e16ad

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3940	SCHTASKS.exe
1964	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5772	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5772	taskmgr.exe
Token: SeSystemProfilePrivilege	5772	taskmgr.exe
Token: SeCreateGlobalPrivilege	5772	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe
5772	taskmgr.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4084	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	82
PID 3892 wrote to memory of 4084	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	82
PID 3892 wrote to memory of 4084	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	82
PID 3892 wrote to memory of 4256	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	83
PID 3892 wrote to memory of 4256	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	83
PID 3892 wrote to memory of 4256	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	83
PID 3892 wrote to memory of 5068	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	84
PID 3892 wrote to memory of 5068	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	84
PID 3892 wrote to memory of 5068	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	84
PID 4280 wrote to memory of 2940	4280	msedge.exe	94
PID 4280 wrote to memory of 2940	4280	msedge.exe	94
PID 1740 wrote to memory of 2128	1740	msedge.exe	98
PID 1740 wrote to memory of 2128	1740	msedge.exe	98
PID 3892 wrote to memory of 3940	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	102
PID 3892 wrote to memory of 3940	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	102
PID 3892 wrote to memory of 3940	3892	2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe	102
PID 5628 wrote to memory of 1308	5628	msedge.exe	106
PID 5628 wrote to memory of 1308	5628	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:4084
- C:\Windows\SysWOW64\icacls.exe
  icacls "E:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:4256
- C:\Windows\SysWOW64\icacls.exe
  icacls "F:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:5068
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /CREATE /NP /SC DAILY /TN "PrintRP" /TR "C:\Windows\System32\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\hJj1w.dll" /ST 10:25 /SD 01/29/2025 /ED 02/05/2025
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3940
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /CREATE /NP /SC DAILY /TN "PrintXu" /TR "C:\Windows\System32\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\zJX2t.dll" /ST 10:25 /SD 01/29/2025 /ED 02/05/2025
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RyukReadMe.html
1⤵
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffaffd546f8,0x7ffaffd54708,0x7ffaffd54718
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Public\Desktop\RyukReadMe.html
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaffd546f8,0x7ffaffd54708,0x7ffaffd54718
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Public\Desktop\RyukReadMe.html
1⤵
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaffd546f8,0x7ffaffd54708,0x7ffaffd54718
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RyukReadMe.html
1⤵
PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaffd546f8,0x7ffaffd54708,0x7ffaffd54718
  2⤵
  PID:6164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RyukReadMe.html
1⤵
PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaffd546f8,0x7ffaffd54708,0x7ffaffd54718
  2⤵
  PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Public\Desktop\RyukReadMe.html
1⤵
PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaffd546f8,0x7ffaffd54708,0x7ffaffd54718
  2⤵
  PID:6536

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Public\Desktop\RyukReadMe.html"
1⤵
PID:7084
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Public\Desktop\RyukReadMe.html
  2⤵
  PID:5612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1896 -prefsLen 27197 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6c98404-24a6-4c20-b586-424dac1a1c2a} 5612 "\\.\pipe\gecko-crash-server-pipe.5612" gpu
    3⤵
    PID:6012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 28117 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c706bf6-44b7-47cb-8801-3db654ca6bb1} 5612 "\\.\pipe\gecko-crash-server-pipe.5612" socket
    3⤵
    PID:1844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2752 -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3048 -prefsLen 28258 -prefMapSize 244658 -jsInitHandle 1120 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88497b53-6740-48de-948a-574e84827579} 5612 "\\.\pipe\gecko-crash-server-pipe.5612" tab
    3⤵
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3424 -childID 2 -isForBrowser -prefsHandle 3512 -prefMapHandle 2940 -prefsLen 32607 -prefMapSize 244658 -jsInitHandle 1120 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63e8a3dc-8841-4de6-87af-d289979ddf04} 5612 "\\.\pipe\gecko-crash-server-pipe.5612" tab
    3⤵
    PID:6068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4604 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4564 -prefMapHandle 4572 -prefsLen 32607 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b913d713-4c68-4fe3-b1f5-a59430f6359a} 5612 "\\.\pipe\gecko-crash-server-pipe.5612" utility
    3⤵
    PID:6240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5172 -childID 3 -isForBrowser -prefsHandle 5128 -prefMapHandle 5148 -prefsLen 27038 -prefMapSize 244658 -jsInitHandle 1120 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {887df769-36e4-4b6c-9dfc-20fc3938b430} 5612 "\\.\pipe\gecko-crash-server-pipe.5612" tab
    3⤵
    PID:3472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 4 -isForBrowser -prefsHandle 5404 -prefMapHandle 5400 -prefsLen 27038 -prefMapSize 244658 -jsInitHandle 1120 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bec4028-0f15-4a4f-9bf8-7e5f27f2a8a1} 5612 "\\.\pipe\gecko-crash-server-pipe.5612" tab
    3⤵
    PID:6808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5520 -childID 5 -isForBrowser -prefsHandle 5596 -prefMapHandle 5592 -prefsLen 27038 -prefMapSize 244658 -jsInitHandle 1120 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {852d64b1-f875-4371-a893-f0bb2117bda3} 5612 "\\.\pipe\gecko-crash-server-pipe.5612" tab
    3⤵
    PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery