lokibot | 1e414463710f5eee406e44815894e93a945289a50a2e8cfa9deef40d7c2e2de3

Analysis

max time kernel
2100s
max time network
2093s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ex2d.exe
Size

1.0MB
MD5

9c727dc787a39ab9b922995de8c1ad99
SHA1

1a0fab414c33759fdecbec52460a8d596c434a19
SHA256

1e414463710f5eee406e44815894e93a945289a50a2e8cfa9deef40d7c2e2de3
SHA512

c74691ca8821faed1a8cd2ab7112e91ba90326a24e01a3f7077ae179c8b458452784b0634b19242795ee2b025ae689f8e08d8b01f5d2552b9df2a9ae60536e35
SSDEEP

24576:rmoO8itEqfZBBoIroaajDce2wia6Gx9UtZmSx00MNFe32UkqD/XDuH+o:qvZrrZU56cc8NFe32UkC+f

Score

10^/10

lokibot modiloader collection persistence spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://batlxt.org/blL0/pin.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 12 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe	modiloader_stage1
behavioral1/memory/2892-36-0x0000000000400000-0x0000000000700000-memory.dmp	modiloader_stage1
behavioral1/memory/2632-432-0x0000000000400000-0x0000000000700000-memory.dmp	modiloader_stage1
behavioral1/memory/1640-439-0x0000000000400000-0x0000000000700000-memory.dmp	modiloader_stage1
behavioral1/memory/2976-446-0x0000000000400000-0x0000000000700000-memory.dmp	modiloader_stage1
behavioral1/memory/2364-454-0x0000000000400000-0x0000000000700000-memory.dmp	modiloader_stage1
behavioral1/memory/1336-472-0x0000000000400000-0x0000000000700000-memory.dmp	modiloader_stage1
behavioral1/memory/1556-492-0x0000000000400000-0x0000000000700000-memory.dmp	modiloader_stage1
behavioral1/memory/1916-499-0x0000000000400000-0x0000000000700000-memory.dmp	modiloader_stage1
behavioral1/memory/1624-543-0x0000000000400000-0x0000000000700000-memory.dmp	modiloader_stage1
behavioral1/memory/2516-550-0x0000000000400000-0x0000000000700000-memory.dmp	modiloader_stage1
behavioral1/memory/2812-644-0x0000000140000000-0x00000001405E8000-memory.dmp	modiloader_stage1

Executes dropped EXE 11 IoCs

Processes:

pmwfr.exepmwfr.exepmwfr.exepmwfr.exepmwfr.exepmwfr.exepmwfr.exepmwfr.exepmseo.exepmseo.exepmwfr.exe

pid process

2892 pmwfr.exe
2632 pmwfr.exe
1640 pmwfr.exe
2976 pmwfr.exe
2364 pmwfr.exe
1336 pmwfr.exe
1556 pmwfr.exe
1916 pmwfr.exe
1624 pmseo.exe
2516 pmseo.exe
2768 pmwfr.exe
Loads dropped DLL 4 IoCs

Processes:

ex2d.exe

pid process

836 ex2d.exe
836 ex2d.exe
836 ex2d.exe
836 ex2d.exe

pid	process
2892	pmwfr.exe
2632	pmwfr.exe
1640	pmwfr.exe
2976	pmwfr.exe
2364	pmwfr.exe
1336	pmwfr.exe
1556	pmwfr.exe
1916	pmwfr.exe
1624	pmseo.exe
2516	pmseo.exe
2768	pmwfr.exe

pid	process
836	ex2d.exe
836	ex2d.exe
836	ex2d.exe
836	ex2d.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

TapiUnattend.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	TapiUnattend.exe
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	TapiUnattend.exe
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	TapiUnattend.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

pmwfr.exepmwfr.exepmseo.exepmwfr.exepmwfr.exepmwfr.exepmwfr.exepmwfr.exepmwfr.exepmseo.exepmwfr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pm = "C:\\Users\\Admin\\Music\\pmero.hta"	pmwfr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pm = "C:\\Users\\Admin\\Music\\pmero.hta"	pmwfr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pm = "C:\\Users\\Admin\\Music\\pmero.hta"	pmseo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pm = "C:\\Users\\Admin\\Music\\pmero.hta"	pmwfr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pm = "C:\\Users\\Admin\\Music\\pmero.hta"	pmwfr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pm = "C:\\Users\\Admin\\Music\\pmero.hta"	pmwfr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pm = "C:\\Users\\Admin\\Music\\pmero.hta"	pmwfr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pm = "C:\\Users\\Admin\\Music\\pmero.hta"	pmwfr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pm = "C:\\Users\\Admin\\Music\\pmero.hta"	pmwfr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pm = "C:\\Users\\Admin\\Music\\pmero.hta"	pmseo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pm = "C:\\Users\\Admin\\Music\\pmero.hta"	pmwfr.exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

pmwfr.exepmwfr.exepmwfr.exepmwfr.exepmwfr.exepmwfr.exepmwfr.exepmwfr.exepmseo.exepmseo.exepmwfr.exe

description	pid	process	target process
PID 2892 set thread context of 2560	2892	pmwfr.exe	TapiUnattend.exe
PID 2632 set thread context of 2608	2632	pmwfr.exe	TapiUnattend.exe
PID 1640 set thread context of 2636	1640	pmwfr.exe	TapiUnattend.exe
PID 2976 set thread context of 2516	2976	pmwfr.exe	TapiUnattend.exe
PID 2364 set thread context of 1140	2364	pmwfr.exe	TapiUnattend.exe
PID 1336 set thread context of 1768	1336	pmwfr.exe	TapiUnattend.exe
PID 1556 set thread context of 1724	1556	pmwfr.exe	TapiUnattend.exe
PID 1916 set thread context of 2128	1916	pmwfr.exe	TapiUnattend.exe
PID 1624 set thread context of 2776	1624	pmseo.exe	TapiUnattend.exe
PID 2516 set thread context of 2168	2516	pmseo.exe	TapiUnattend.exe
PID 2768 set thread context of 2564	2768	pmwfr.exe	TapiUnattend.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2472 EXCEL.EXE

pid	process
2472	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exe

pid	process
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

2812 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

TapiUnattend.exefirefox.exeAUDIODG.EXEtaskmgr.exeEXCEL.EXE

description	pid	process
Token: SeDebugPrivilege	2560	TapiUnattend.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: SeDebugPrivilege	1800	firefox.exe
Token: 33	2412	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2412	AUDIODG.EXE
Token: 33	2412	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2412	AUDIODG.EXE
Token: SeDebugPrivilege	2812	taskmgr.exe
Token: SeShutdownPrivilege	2472	EXCEL.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
1800	firefox.exe
1800	firefox.exe
1800	firefox.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe
2812	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

EXCEL.EXE

pid process

2472 EXCEL.EXE
2472 EXCEL.EXE
2472 EXCEL.EXE
2472 EXCEL.EXE
2472 EXCEL.EXE
2472 EXCEL.EXE
2472 EXCEL.EXE
2472 EXCEL.EXE

pid	process
2472	EXCEL.EXE
2472	EXCEL.EXE
2472	EXCEL.EXE
2472	EXCEL.EXE
2472	EXCEL.EXE
2472	EXCEL.EXE
2472	EXCEL.EXE
2472	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ex2d.exepmwfr.exefirefox.exefirefox.exe

description	pid	process	target process
PID 836 wrote to memory of 2892	836	ex2d.exe	pmwfr.exe
PID 836 wrote to memory of 2892	836	ex2d.exe	pmwfr.exe
PID 836 wrote to memory of 2892	836	ex2d.exe	pmwfr.exe
PID 836 wrote to memory of 2892	836	ex2d.exe	pmwfr.exe
PID 2892 wrote to memory of 2560	2892	pmwfr.exe	TapiUnattend.exe
PID 2892 wrote to memory of 2560	2892	pmwfr.exe	TapiUnattend.exe
PID 2892 wrote to memory of 2560	2892	pmwfr.exe	TapiUnattend.exe
PID 2892 wrote to memory of 2560	2892	pmwfr.exe	TapiUnattend.exe
PID 2892 wrote to memory of 2560	2892	pmwfr.exe	TapiUnattend.exe
PID 2892 wrote to memory of 2560	2892	pmwfr.exe	TapiUnattend.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1800	1524	firefox.exe	firefox.exe
PID 1800 wrote to memory of 1300	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 1300	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 1300	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe
PID 1800 wrote to memory of 2116	1800	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
outlook_office_path 1 IoCs

Processes:

TapiUnattend.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook TapiUnattend.exe
outlook_win_path 1 IoCs

Processes:

TapiUnattend.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook TapiUnattend.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	TapiUnattend.exe

C:\Users\Admin\AppData\Local\Temp\ex2d.exe
"C:\Users\Admin\AppData\Local\Temp\ex2d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe
"C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2892

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2560

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.0.1901512625\705492602" -parentBuildID 20221007134813 -prefsHandle 1212 -prefMapHandle 1204 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {49299085-d457-4293-9670-77402403ed71} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 1276 107d8e58 gpu
3⤵
PID:1300

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.1.911433543\728354845" -parentBuildID 20221007134813 -prefsHandle 1468 -prefMapHandle 1464 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4789124-122f-4f9d-80fc-4f6514fbe7ad} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 1480 f6fb58 socket
3⤵
- Checks processor information in registry
PID:2116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.2.1932081915\2122007732" -childID 1 -isForBrowser -prefsHandle 1860 -prefMapHandle 2000 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7daa61e-d75d-44cd-86ca-0822887fec0d} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 1984 10758e58 tab
3⤵
PID:2496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.3.522343061\430031454" -childID 2 -isForBrowser -prefsHandle 2420 -prefMapHandle 2540 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {daf3ed17-4d15-49d1-bfef-c3dcd572fe51} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 2516 1b838d58 tab
3⤵
PID:2852

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.4.961478615\1175011491" -childID 3 -isForBrowser -prefsHandle 2952 -prefMapHandle 2948 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf74700d-7530-4edc-96cd-f143539bffc9} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 2964 f61958 tab
3⤵
PID:944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.5.1498139789\454547583" -childID 4 -isForBrowser -prefsHandle 3748 -prefMapHandle 3744 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6729705b-e0ee-4795-8411-4d7f22b0b010} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 3760 1a091158 tab
3⤵
PID:2164

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.6.467116705\927862952" -childID 5 -isForBrowser -prefsHandle 3868 -prefMapHandle 3872 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea8f5d3c-688c-4304-953d-adadd5d4a817} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 3856 1f0e1558 tab
3⤵
PID:580

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1800.7.1223538922\1429201684" -childID 6 -isForBrowser -prefsHandle 4052 -prefMapHandle 4056 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {457c9026-5031-47e0-9c22-4129f327cece} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" 4040 1f0e2158 tab
3⤵
PID:1168

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe
"C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2632

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
2⤵
PID:2608

C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe
"C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1640

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
2⤵
PID:2636

C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe
"C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2976

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
2⤵
PID:2516

C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe
"C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2364

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
2⤵
PID:1140

C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe
"C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1336

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
2⤵
PID:1768

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:2772

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:2512

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:2800

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:560

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:2488

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:2480

C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe
"C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1556

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
2⤵
PID:1724

C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe
"C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1916

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
2⤵
PID:2128

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:1752

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:2164

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:3060

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:1996

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:2440

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:2300

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:2660

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:2060

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:1088

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:3064

C:\Windows\System32\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
1⤵
PID:2012

C:\Users\Admin\Contacts\pmseo.exe
"C:\Users\Admin\Contacts\pmseo.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1624

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
2⤵
PID:2776

C:\Users\Admin\Contacts\pmseo.exe
"C:\Users\Admin\Contacts\pmseo.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2516

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
2⤵
PID:2168

C:\Program Files\Windows Mail\wab.exe
"C:\Program Files\Windows Mail\wab.exe" /contact "C:\Users\Admin\Contacts\Admin.contact"
1⤵
PID:2144

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2472

C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe
"C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2768

C:\Windows\SysWOW64\TapiUnattend.exe
"C:\Windows\System32\TapiUnattend.exe"
2⤵
PID:2564

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2812

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\15kjbvz9.default-release\activity-stream.discovery_stream.json.tmp
Filesize
30KB

MD5
ab87d59949f09c9036cef34241a6a6a7

SHA1
8652943a3038f27bb7d78dc830923ca5203d10c5

SHA256
2aefd90bf48516614f97af260b33c9e504f6e0419fed9a7fbe2f6ce9f3efa0cd

SHA512
0fa62f54a1d701385244b0d43d6510d057e47d2f749cd142eab84b8f94056f62df42d512c843fd30cdb99c278f81aca0cf51ce7bb082e1680d87b194115d6338

Download Submit
C:\Users\Admin\AppData\Local\Temp\pm.pngc\pm.png
Filesize
570KB

MD5
8ad676dd7492a10768e8dbfdb25f5462

SHA1
22363d608e2e630e354f4d3dace5d15c2495b9c1

SHA256
c4bd361e8127437a039f09036985262ac3041ae9085a1e99584ea8ce742a9269

SHA512
f1946e789957d7ee625d168f636b1a624f58743fd357829d4b7ed5843345634b7c6571cc8b558734f811e6cdf354d8897b5c1d13c954894d7aa07313e113cd85

Download Submit
C:\Users\Admin\AppData\Local\Temp\pm.pngc\pmwfr.exe
Filesize
886KB

MD5
7866de22baa38c927b53fc331fcde99e

SHA1
ca899afd50fbb88da439ca8e492b2a992cebe948

SHA256
0171e836f4a7ffbf66dea654f4bce360578ba8493032acd2a1b7c8d64cf4b79c

SHA512
d3047dfab772a0c9db64d24aa1bc09e07056118e5b964fd09feacde040a7ad0d0c97299596b38b059271fa7ae71e3542ea02e2bfe41d88839ba400381b9b45c4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-39690363-730359138-1046745555-1000\0f5007522459c86e95ffcc62f32308f1_793829ab-9e00-42f6-8ab9-a6ffde9cf44a
Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-39690363-730359138-1046745555-1000\0f5007522459c86e95ffcc62f32308f1_793829ab-9e00-42f6-8ab9-a6ffde9cf44a
Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
110be82fc8e9784f0fcbb83717e47c30

SHA1
930b52df573b37685000d1b9e0efc77039f51824

SHA256
d5955c84ba2eaf5aa0e88ec45027dde1059620e72a11e71a4bb38b66e1d09e91

SHA512
622f95d4cefc3ed36bec234d141c245795899a76a46a66d2fffec14027c97ee53a955510f559b6884069bfa5b7ff6d0c5af411c2a37230dd915032dedf7a3e5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\datareporting\glean\pending_pings\eee138c6-8a97-44db-bf88-2efdde17f9bc
Filesize
745B

MD5
e3668990f6b03097bc0d7832586b4072

SHA1
92baca4ebc6dbd498458ac114eb7044820cc1188

SHA256
a20aed72da150c242fb5967eae892b59e2471eeb5e00bbcf11e1f59c49933cf1

SHA512
68d47dc7e160e17d8c2c36eb0be4e7c2b6b89f212a31ccada5ea0a0acc69fcd804f0cdff2b93629d4f07c04fe95862cc219acd681a58c13b6024c9d2976ad0a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\datareporting\glean\pending_pings\f3e95b38-4c7f-4766-a234-b47f830bde29
Filesize
11KB

MD5
fc431d64aad98a6dcedca596e8c15774

SHA1
3abfa3926d8d9baaeca8bd65cc148ef04f9ef5ed

SHA256
f2a6d4ec4d5e7bd8aba8f19327faa78bec8db234301c53807c2a2a08f5ea8011

SHA512
dc9d0070f7e207f32f64f71d599f18dd5a5874cbc14d0bdb46b784e859eca6dae41c855736135973f77ba7312672501c9a70cf023d17aa90a9873bb08e85fcde

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\prefs-1.js
Filesize
6KB

MD5
17ccaaf28c5889e6b48b69622a171258

SHA1
0381fe16f4f261a1f8b0726cb4d91defb58ef09d

SHA256
0faa0913f087e1cc5986e4a8fa0998beacdc623e2370d275723d305dd507634a

SHA512
f4525719e10683c44a4e5b8f88610c53cb200588579575fbfadb700cabaa827cc67ca860574e9295bc297e0be24efbeebb5da02945045cd42c7faac72f039da5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\15kjbvz9.default-release\sessionstore.jsonlz4
Filesize
835B

MD5
c30b91fbbf90674b1db6dcf3d9ad26a8

SHA1
93bd2f5e0ef2c060d678a967f571cdf620ba65f0

SHA256
5a93f9834a5c68f59b94989e6b17b80eba4f15336daf7958ab09930035523a8b

SHA512
b74a2a392e0dadac48679c6a0e4a1cff2084330d69ed304f7d8c0959ebda519a94031c759401bc5cdf0e574f937567f8c37cbc1de3c098e647ae0e5b1d04911e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1336-472-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1556-492-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1624-543-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1640-439-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1916-499-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/2364-454-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/2472-611-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2516-550-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/2560-32-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2560-35-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2560-37-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/2560-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2608-430-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2632-432-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/2812-644-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2812-645-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2812-646-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2892-36-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/2976-446-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download