b01239f70e7435aee4056bf808e3b6896ae29399a8b80833d78a858ad4fc9ef9

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-08-14_6e73675243ea117952a4cae1bf61ddf7_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe

Executes dropped EXE 10 IoCs

pid	Process
5032	javaw.exe
4368	runtime_helper.exe
4612	runtime_helper.exe
4052	runtime_helper.exe
5076	runtime_helper.exe
376	runtime_helper.exe
1404	runtime_helper.exe
708	runtime_helper.exe
536	runtime_helper.exe
2660	runtime_helper.exe

Loads dropped DLL 12 IoCs

pid	Process
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "wscript.exe //B C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\wus_watcher.vbs"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
31	discord.com
32	discord.com
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	javaw.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2484	wscript.exe
2972	wscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4636	cmd.exe
2500	cmd.exe
4440	cmd.exe
2996	cmd.exe
3804	cmd.exe
2656	cmd.exe
2572	cmd.exe
5112	cmd.exe
4040	cmd.exe
3124	cmd.exe
2780	cmd.exe
4780	cmd.exe
3716	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javaw.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
4048	wmic.exe

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
2592	taskkill.exe
632	taskkill.exe
1200	taskkill.exe
1972	taskkill.exe
4128	taskkill.exe
1712	taskkill.exe
3976	taskkill.exe
552	taskkill.exe
3884	taskkill.exe
1840	taskkill.exe
952	taskkill.exe
3056	taskkill.exe
2760	taskkill.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
3768	reg.exe
1096	reg.exe
4412	reg.exe
1840	reg.exe
5116	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2188	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe
5032	javaw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	taskkill.exe
Token: SeDebugPrivilege	1840	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	2760	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4048	wmic.exe
Token: SeSecurityPrivilege	4048	wmic.exe
Token: SeTakeOwnershipPrivilege	4048	wmic.exe
Token: SeLoadDriverPrivilege	4048	wmic.exe
Token: SeSystemProfilePrivilege	4048	wmic.exe
Token: SeSystemtimePrivilege	4048	wmic.exe
Token: SeProfSingleProcessPrivilege	4048	wmic.exe
Token: SeIncBasePriorityPrivilege	4048	wmic.exe
Token: SeCreatePagefilePrivilege	4048	wmic.exe
Token: SeBackupPrivilege	4048	wmic.exe
Token: SeRestorePrivilege	4048	wmic.exe
Token: SeShutdownPrivilege	4048	wmic.exe
Token: SeDebugPrivilege	4048	wmic.exe
Token: SeSystemEnvironmentPrivilege	4048	wmic.exe
Token: SeRemoteShutdownPrivilege	4048	wmic.exe
Token: SeUndockPrivilege	4048	wmic.exe
Token: SeManageVolumePrivilege	4048	wmic.exe
Token: 33	4048	wmic.exe
Token: 34	4048	wmic.exe
Token: 35	4048	wmic.exe
Token: 36	4048	wmic.exe
Token: SeIncreaseQuotaPrivilege	4048	wmic.exe
Token: SeSecurityPrivilege	4048	wmic.exe
Token: SeTakeOwnershipPrivilege	4048	wmic.exe
Token: SeLoadDriverPrivilege	4048	wmic.exe
Token: SeSystemProfilePrivilege	4048	wmic.exe
Token: SeSystemtimePrivilege	4048	wmic.exe
Token: SeProfSingleProcessPrivilege	4048	wmic.exe
Token: SeIncBasePriorityPrivilege	4048	wmic.exe
Token: SeCreatePagefilePrivilege	4048	wmic.exe
Token: SeBackupPrivilege	4048	wmic.exe
Token: SeRestorePrivilege	4048	wmic.exe
Token: SeShutdownPrivilege	4048	wmic.exe
Token: SeDebugPrivilege	4048	wmic.exe
Token: SeSystemEnvironmentPrivilege	4048	wmic.exe
Token: SeRemoteShutdownPrivilege	4048	wmic.exe
Token: SeUndockPrivilege	4048	wmic.exe
Token: SeManageVolumePrivilege	4048	wmic.exe
Token: 33	4048	wmic.exe
Token: 34	4048	wmic.exe
Token: 35	4048	wmic.exe
Token: 36	4048	wmic.exe
Token: SeIncreaseQuotaPrivilege	1440	wmic.exe
Token: SeSecurityPrivilege	1440	wmic.exe
Token: SeTakeOwnershipPrivilege	1440	wmic.exe
Token: SeLoadDriverPrivilege	1440	wmic.exe
Token: SeSystemProfilePrivilege	1440	wmic.exe
Token: SeSystemtimePrivilege	1440	wmic.exe
Token: SeProfSingleProcessPrivilege	1440	wmic.exe
Token: SeIncBasePriorityPrivilege	1440	wmic.exe
Token: SeCreatePagefilePrivilege	1440	wmic.exe
Token: SeBackupPrivilege	1440	wmic.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 5032	1516	2026-08-14_6e73675243ea117952a4cae1bf61ddf7_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	87
PID 5032 wrote to memory of 2484	5032	javaw.exe	91
PID 5032 wrote to memory of 2972	5032	javaw.exe	92
PID 5032 wrote to memory of 1840	5032	javaw.exe	93
PID 5032 wrote to memory of 2188	5032	javaw.exe	95
PID 5032 wrote to memory of 4368	5032	javaw.exe	97
PID 4368 wrote to memory of 452	4368	runtime_helper.exe	102
PID 4368 wrote to memory of 452	4368	runtime_helper.exe	102
PID 5032 wrote to memory of 4612	5032	javaw.exe	105
PID 4612 wrote to memory of 4820	4612	runtime_helper.exe	107
PID 4612 wrote to memory of 4820	4612	runtime_helper.exe	107
PID 5032 wrote to memory of 4052	5032	javaw.exe	108
PID 4052 wrote to memory of 1456	4052	runtime_helper.exe	110
PID 4052 wrote to memory of 1456	4052	runtime_helper.exe	110
PID 4052 wrote to memory of 4868	4052	runtime_helper.exe	114
PID 4052 wrote to memory of 4868	4052	runtime_helper.exe	114
PID 5032 wrote to memory of 5076	5032	javaw.exe	115
PID 5076 wrote to memory of 1768	5076	runtime_helper.exe	117
PID 5076 wrote to memory of 1768	5076	runtime_helper.exe	117
PID 5032 wrote to memory of 376	5032	javaw.exe	120
PID 376 wrote to memory of 4768	376	runtime_helper.exe	127
PID 376 wrote to memory of 4768	376	runtime_helper.exe	127
PID 5032 wrote to memory of 1404	5032	javaw.exe	128
PID 5032 wrote to memory of 708	5032	javaw.exe	130
PID 5032 wrote to memory of 536	5032	javaw.exe	132
PID 5032 wrote to memory of 2660	5032	javaw.exe	134
PID 5032 wrote to memory of 4636	5032	javaw.exe	136
PID 4636 wrote to memory of 632	4636	cmd.exe	138
PID 5032 wrote to memory of 2500	5032	javaw.exe	139
PID 2500 wrote to memory of 1840	2500	cmd.exe	141
PID 5032 wrote to memory of 4440	5032	javaw.exe	142
PID 4440 wrote to memory of 952	4440	cmd.exe	144
PID 5032 wrote to memory of 4040	5032	javaw.exe	145
PID 4040 wrote to memory of 1200	4040	cmd.exe	147
PID 5032 wrote to memory of 2996	5032	javaw.exe	148
PID 2996 wrote to memory of 1972	2996	cmd.exe	150
PID 5032 wrote to memory of 3124	5032	javaw.exe	151
PID 3124 wrote to memory of 3056	3124	cmd.exe	153
PID 5032 wrote to memory of 3804	5032	javaw.exe	154
PID 3804 wrote to memory of 4128	3804	cmd.exe	156
PID 5032 wrote to memory of 2656	5032	javaw.exe	157
PID 2656 wrote to memory of 2760	2656	cmd.exe	159
PID 5032 wrote to memory of 2780	5032	javaw.exe	160
PID 2780 wrote to memory of 1712	2780	cmd.exe	162
PID 5032 wrote to memory of 4780	5032	javaw.exe	163
PID 4780 wrote to memory of 3976	4780	cmd.exe	165
PID 5032 wrote to memory of 2572	5032	javaw.exe	166
PID 2572 wrote to memory of 2592	2572	cmd.exe	168
PID 5032 wrote to memory of 3716	5032	javaw.exe	169
PID 3716 wrote to memory of 552	3716	cmd.exe	171
PID 5032 wrote to memory of 5112	5032	javaw.exe	172
PID 5112 wrote to memory of 3884	5112	cmd.exe	174
PID 5032 wrote to memory of 4048	5032	javaw.exe	175
PID 5032 wrote to memory of 1440	5032	javaw.exe	177
PID 5032 wrote to memory of 5116	5032	javaw.exe	179
PID 5032 wrote to memory of 3768	5032	javaw.exe	181
PID 5032 wrote to memory of 1096	5032	javaw.exe	183
PID 5032 wrote to memory of 4412	5032	javaw.exe	185

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-14_6e73675243ea117952a4cae1bf61ddf7_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_6e73675243ea117952a4cae1bf61ddf7_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\modules.jar;C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\libs\* e C:\Users\Admin\AppData\Local\Temp\2026-08-14_6e73675243ea117952a4cae1bf61ddf7_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe --force
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe //B C:\Users\Admin\AppData\Local\Temp\wus_1786671553077.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2484
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe //B C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wus_watcher.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2972
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateService /t REG_SZ /d "wscript.exe //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wus_watcher.vbs"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1840
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn WindowsUpdateService /tr "wscript.exe //B "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\wus_watcher.vbs"" /sc onlogon /delay 0001:00 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2188
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe chrome -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_608d9b11 -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:452
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe edge -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_4f76cfba -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4820
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe all -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_fb64b361 -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4868
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe chrome -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_a7eb61fe -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1768
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe edge -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_eea69987 -k
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4768
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe brave -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_e3c5df5a -k
    3⤵
    - Executes dropped EXE
    PID:1404
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe avast -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_e4d8953f -k
    3⤵
    - Executes dropped EXE
    PID:708
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe opera -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_b5ae4e51 -k
    3⤵
    - Executes dropped EXE
    PID:536
- - C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe
    C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\92d6bf448df08687c29e\native\runtime_helper.exe vivaldi -o C:\Users\Admin\AppData\Local\Temp\soul_chromelevator_0573a14f -k
    3⤵
    - Executes dropped EXE
    PID:2660
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im brave.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im brave.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:632
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im waterfox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im waterfox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1840
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im msedge.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:952
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im yandexbrowser.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im yandexbrowser.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1200
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im firefox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1972
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im librewolf.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im librewolf.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3056
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im chrome.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4128
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im opera.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im opera.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im vivaldi.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im vivaldi.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im opera_gx.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im opera_gx.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3976
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im waterfox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im waterfox.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2592
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im firefox.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im firefox.exe
      4⤵
      Kills process with taskkill
      PID:552
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /f /im librewolf.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im librewolf.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3884
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- - C:\Windows\System32\Wbem\wmic.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox /s
    3⤵
    - Modifies registry key
    PID:5116
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox\RobloxStudio /s
    3⤵
    - Modifies registry key
    PID:3768
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Roblox\RobloxPlayer /s
    3⤵
    - Modifies registry key
    PID:1096
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKCU\Software\Valve\Steam /v SteamPath
    3⤵
    - Modifies registry key
    PID:4412

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery