ratonrat | a178b8c3fd83c3362fa389746477f324c1fd96de3c66887793602dc2ae1265e5

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	free.gta.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	free.gta.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	free.gta.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	free.gta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	free.gta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2524	chrome.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330873124250198"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5872	chrome.exe
5872	chrome.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe
5512	free.gta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5512	free.gta.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeShutdownPrivilege	5872	chrome.exe
Token: SeCreatePagefilePrivilege	5872	chrome.exe
Token: SeDebugPrivilege	6088	firefox.exe
Token: SeDebugPrivilege	6088	firefox.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
6088	firefox.exe
6088	firefox.exe
6088	firefox.exe
6088	firefox.exe
6088	firefox.exe
6088	firefox.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe
5872	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6088	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5512 wrote to memory of 1524	5512	free.gta.exe	90
PID 5872 wrote to memory of 956	5872	chrome.exe	95
PID 5872 wrote to memory of 5452	5872	chrome.exe	96
PID 5872 wrote to memory of 5452	5872	chrome.exe	96
PID 5872 wrote to memory of 2524	5872	chrome.exe	97
PID 5872 wrote to memory of 5824	5872	chrome.exe	99
PID 5872 wrote to memory of 5824	5872	chrome.exe	99
PID 5872 wrote to memory of 6132	5872	chrome.exe	100
PID 5872 wrote to memory of 6132	5872	chrome.exe	100
PID 5872 wrote to memory of 5644	5872	chrome.exe	101
PID 5872 wrote to memory of 5644	5872	chrome.exe	101
PID 5872 wrote to memory of 3864	5872	chrome.exe	102
PID 5872 wrote to memory of 3864	5872	chrome.exe	102
PID 5872 wrote to memory of 5816	5872	chrome.exe	103
PID 5872 wrote to memory of 5816	5872	chrome.exe	103
PID 5872 wrote to memory of 1304	5872	chrome.exe	105
PID 5872 wrote to memory of 4724	5872	chrome.exe	106
PID 5872 wrote to memory of 4724	5872	chrome.exe	106
PID 5872 wrote to memory of 4272	5872	chrome.exe	107
PID 5872 wrote to memory of 4272	5872	chrome.exe	107
PID 5872 wrote to memory of 428	5872	chrome.exe	110
PID 5872 wrote to memory of 1580	5872	chrome.exe	111
PID 5872 wrote to memory of 428	5872	chrome.exe	110
PID 5872 wrote to memory of 1580	5872	chrome.exe	111
PID 5872 wrote to memory of 3236	5872	chrome.exe	112
PID 5872 wrote to memory of 1964	5872	chrome.exe	113
PID 5872 wrote to memory of 3236	5872	chrome.exe	112
PID 5872 wrote to memory of 1964	5872	chrome.exe	113
PID 5872 wrote to memory of 5364	5872	chrome.exe	114
PID 5872 wrote to memory of 5364	5872	chrome.exe	114
PID 5872 wrote to memory of 2960	5872	chrome.exe	115
PID 5872 wrote to memory of 2960	5872	chrome.exe	115
PID 2300 wrote to memory of 6088	2300	firefox.exe	117
PID 2300 wrote to memory of 6088	2300	firefox.exe	117
PID 6088 wrote to memory of 5980	6088	firefox.exe	118
PID 6088 wrote to memory of 5980	6088	firefox.exe	118
PID 6088 wrote to memory of 5980	6088	firefox.exe	118
PID 6088 wrote to memory of 2140	6088	firefox.exe	119
PID 6088 wrote to memory of 2140	6088	firefox.exe	119
PID 6088 wrote to memory of 2140	6088	firefox.exe	119
PID 6088 wrote to memory of 2140	6088	firefox.exe	119
PID 6088 wrote to memory of 2716	6088	firefox.exe	120
PID 6088 wrote to memory of 2716	6088	firefox.exe	120
PID 6088 wrote to memory of 2716	6088	firefox.exe	120
PID 6088 wrote to memory of 2716	6088	firefox.exe	120
PID 6088 wrote to memory of 4840	6088	firefox.exe	121
PID 6088 wrote to memory of 4840	6088	firefox.exe	121
PID 6088 wrote to memory of 4840	6088	firefox.exe	121
PID 6088 wrote to memory of 2936	6088	firefox.exe	122
PID 6088 wrote to memory of 2936	6088	firefox.exe	122
PID 6088 wrote to memory of 2936	6088	firefox.exe	122
PID 6088 wrote to memory of 2936	6088	firefox.exe	122
PID 6088 wrote to memory of 4316	6088	firefox.exe	123
PID 6088 wrote to memory of 4316	6088	firefox.exe	123
PID 6088 wrote to memory of 4316	6088	firefox.exe	123
PID 6088 wrote to memory of 4316	6088	firefox.exe	123
PID 6088 wrote to memory of 3312	6088	firefox.exe	124
PID 6088 wrote to memory of 3312	6088	firefox.exe	124
PID 6088 wrote to memory of 3312	6088	firefox.exe	124
PID 6088 wrote to memory of 3312	6088	firefox.exe	124
PID 6088 wrote to memory of 5884	6088	firefox.exe	125
PID 6088 wrote to memory of 5884	6088	firefox.exe	125
PID 6088 wrote to memory of 5884	6088	firefox.exe	125
PID 6088 wrote to memory of 5884	6088	firefox.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\free.gta.exe
"C:\Users\Admin\AppData\Local\Temp\free.gta.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5512
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "free.gta" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Local\Temp\free.gta.exe\"" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1524

C:\Users\Admin\AppData\Local\Temp\free.gta.exe
"C:\Users\Admin\AppData\Local\Temp\free.gta.exe"
1⤵
PID:4124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ff89abfc728,0x7ff89abfc734,0x7ff89abfc740
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,18239173893396972657,11391078411788950746,262144 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,15013230200387584347,9513238929329997286,524288 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,12643702531178786367,15701767494974511617,524288 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,5954393920252578910,18362277783363002997,2097152 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,11984231652861416119,1512581834138833073,2097152 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4656,i,10174649238682614045,12176721671263133548,2097152 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,13600252434048948206,4543000935691013807,524288 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,6113814997708622547,2503293779643666319,524288 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5480,i,8621743065632109469,15377436087146189509,2097152 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5496,i,14404937967746516592,1290027573825733844,2097152 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5780,i,15436855325903926516,2503788708403933868,2097152 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5808,i,14990611405001818399,13444127806719803114,2097152 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5728,i,5263939107399767906,335930032977854220,2097152 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5932,i,6426546964303361529,11990954528464753470,2097152 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6048,i,159324576709969998,15483734658836392575,2097152 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5596,i,1938650072281042756,2722938582162532365,2097152 --field-trial-handle=1880,i,10695573392739422056,75097769938020071,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5804

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1936 -prefsLen 27097 -prefMapHandle 1940 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {b219dd99-ecf4-4342-ae4a-0319a6a8282c} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27133 -prefMapHandle 2404 -prefMapSize 270279 -ipcHandle 2412 -initialChannelId {64947844-1fdd-4b12-93f3-cc768c0ec269} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3908 -prefsLen 27274 -prefMapHandle 3912 -prefMapSize 270279 -jsInitHandle 3916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3924 -initialChannelId {a2fd0539-f54e-4462-8e20-3ac7138ea5b1} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4060 -prefsLen 27274 -prefMapHandle 4064 -prefMapSize 270279 -ipcHandle 4172 -initialChannelId {1611f5a1-c144-491b-8dc4-423a45d0e820} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4420 -prefsLen 34773 -prefMapHandle 4424 -prefMapSize 270279 -jsInitHandle 4428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4436 -initialChannelId {44db75d0-4bcc-4fc4-adf1-0ce03a5fe4a0} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2872 -prefsLen 35010 -prefMapHandle 2876 -prefMapSize 270279 -ipcHandle 5012 -initialChannelId {5512a740-faa8-4532-8b7b-cd89a73b15fb} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5464 -prefsLen 32952 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5440 -initialChannelId {7c3f2518-2678-4364-a752-e9aa24609a40} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5488 -prefsLen 32952 -prefMapHandle 5492 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {294a5209-a172-4360-ad97-311913bf1c58} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5776 -prefsLen 32952 -prefMapHandle 5780 -prefMapSize 270279 -jsInitHandle 5784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5792 -initialChannelId {25b3a582-f3da-45bf-9418-c6ef6e902241} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6384 -prefsLen 33071 -prefMapHandle 3216 -prefMapSize 270279 -jsInitHandle 3224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6196 -initialChannelId {cf74ed63-e2f0-44d9-84ac-41c04dae21f1} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6652 -prefsLen 33071 -prefMapHandle 6656 -prefMapSize 270279 -jsInitHandle 6660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6260 -initialChannelId {f12cc369-7c2c-4ea8-be72-8dd1d927ff0a} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6784 -prefsLen 35198 -prefMapHandle 6588 -prefMapSize 270279 -ipcHandle 6728 -initialChannelId {b10cf40d-8a61-4722-b247-662098a39030} -parentPid 6088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Time Discovery

T1124

Virtualization/Sandbox Evasion