cbfbec1a1000c8f26e8571ee40149181769b7b3e726a106ca0873395ff60b0f7

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
85	3780	firefox.exe

Executes dropped EXE 2 IoCs

pid	Process
5416	NoEscape.exe
5996	NoEscape.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
6	raw.githubusercontent.com
32	raw.githubusercontent.com
85	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "0"	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	NoEscape.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\winnt32.exe	NoEscape.exe
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe
File created	C:\Windows\winnt32.exe\:Zone.Identifier:$DATA	NoEscape.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\NoEscape.exe:Zone.Identifier	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoEscape.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Control Panel 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000\Control Panel\Desktop	NoEscape.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000\Control Panel\Desktop\AutoColorization = "1"	NoEscape.exe
Key created	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000\Control Panel\Mouse	NoEscape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1136229799-3442283115-138161576-1000\Control Panel\Mouse\SwapMouseButtons = "1"	NoEscape.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "98"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\NoEscape.exe:Zone.Identifier	firefox.exe
File created	C:\Windows\winnt32.exe\:Zone.Identifier:$DATA	NoEscape.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3780	firefox.exe
Token: SeDebugPrivilege	3780	firefox.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
3780	firefox.exe
952	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 3780	2140	firefox.exe	85
PID 2140 wrote to memory of 3780	2140	firefox.exe	85
PID 2140 wrote to memory of 3780	2140	firefox.exe	85
PID 2140 wrote to memory of 3780	2140	firefox.exe	85
PID 2140 wrote to memory of 3780	2140	firefox.exe	85
PID 2140 wrote to memory of 3780	2140	firefox.exe	85
PID 2140 wrote to memory of 3780	2140	firefox.exe	85
PID 2140 wrote to memory of 3780	2140	firefox.exe	85
PID 2140 wrote to memory of 3780	2140	firefox.exe	85
PID 2140 wrote to memory of 3780	2140	firefox.exe	85
PID 2140 wrote to memory of 3780	2140	firefox.exe	85
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 4680	3780	firefox.exe	86
PID 3780 wrote to memory of 1476	3780	firefox.exe	87
PID 3780 wrote to memory of 1476	3780	firefox.exe	87
PID 3780 wrote to memory of 1476	3780	firefox.exe	87
PID 3780 wrote to memory of 1476	3780	firefox.exe	87
PID 3780 wrote to memory of 1476	3780	firefox.exe	87
PID 3780 wrote to memory of 1476	3780	firefox.exe	87
PID 3780 wrote to memory of 1476	3780	firefox.exe	87
PID 3780 wrote to memory of 1476	3780	firefox.exe	87

System policy modification 1 TTPs 5 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	NoEscape.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1"	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	NoEscape.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MfW10_Fix_Repair_UWP_V2_Generic\Custom.dll,#1
1⤵
PID:4224

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {6971b956-9cf8-4108-89ea-992098452411} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2312 -initialChannelId {d67a5413-a229-4798-b3d0-bdec561792a2} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 27323 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {0bc31496-0d82-469a-b327-69dff9db4ecf} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27323 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {368a3e7a-c326-4024-a3ea-bc2d0a93ecf6} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1664 -prefsLen 34822 -prefMapHandle 1684 -prefMapSize 270279 -jsInitHandle 2628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3308 -initialChannelId {44e64810-a6e4-43f0-a32f-956878b752d2} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5040 -prefsLen 35010 -prefMapHandle 5044 -prefMapSize 270279 -ipcHandle 2564 -initialChannelId {87f3d34c-a780-4222-a525-cac02bd41f05} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5680 -prefsLen 33031 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2432 -initialChannelId {ccf0c460-ba70-420c-8b37-8046475d0d91} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 33031 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5876 -initialChannelId {6fb794e8-111d-4561-9bb8-e05a27302fab} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6088 -prefsLen 33031 -prefMapHandle 6092 -prefMapSize 270279 -jsInitHandle 6096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6072 -initialChannelId {8c8c4793-7b66-452c-9fd4-aaf4354dd492} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6080 -prefsLen 33071 -prefMapHandle 6084 -prefMapSize 270279 -jsInitHandle 6336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6088 -initialChannelId {21c4d6b0-0cd4-481a-aec0-d2da12984f40} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1424 -prefsLen 33071 -prefMapHandle 3188 -prefMapSize 270279 -jsInitHandle 6532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2944 -initialChannelId {e8facb21-c442-4df4-9e41-0b9bed71ce55} -parentPid 3780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4356

C:\Users\Admin\Downloads\NoEscape.exe
"C:\Users\Admin\Downloads\NoEscape.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5416

C:\Users\Admin\Downloads\NoEscape.exe
"C:\Users\Admin\Downloads\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- NTFS ADS
- System policy modification
PID:5996

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2a855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry