hxxp://google[.]com

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\Program Files\\mrsmajor\\Launcher.vbs\""	wscript.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

wscript.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe
Disables RegEdit via registry modification 1 IoCs
evasion

Processes:

wscript.exe

description ioc process

Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1" wscript.exe
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file
Possible privilege escalation attempt 2 IoCs
exploit

Processes:

icacls.exetakeown.exe

pid process

6104 icacls.exe
6020 takeown.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\disableregistrytools = "1"	wscript.exe

pid	process
6104	icacls.exe
6020	takeown.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

wscript.exeBossDaMajor.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	BossDaMajor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 2 IoCs

Processes:

BossDaMajor.exeBonzify.exe

pid process

3672 BossDaMajor.exe
3676 Bonzify.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

6020 takeown.exe
6104 icacls.exe

pid	process
3672	BossDaMajor.exe
3676	Bonzify.exe

pid	process
6020	takeown.exe
6104	icacls.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe

Drops desktop.ini file(s) 7 IoCs

Processes:

wmplayer.exe

description	ioc	process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

unregmp2.exewmplayer.exe

description	ioc	process
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

193 raw.githubusercontent.com
194 raw.githubusercontent.com
195 raw.githubusercontent.com
196 raw.githubusercontent.com
201 raw.githubusercontent.com

flow	ioc
193	raw.githubusercontent.com
194	raw.githubusercontent.com
195	raw.githubusercontent.com
196	raw.githubusercontent.com
201	raw.githubusercontent.com

Drops file in Program Files directory 16 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Program Files\mrsmajor\MrsMjrGuiLauncher.bat	wscript.exe
File created	C:\Program Files\mrsmajor\DreS_X.bat	wscript.exe
File created	C:\Program Files\mrsmajor\Launcher.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\mrsmajorlauncher.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\MrsMjrGui.exe	wscript.exe
File opened for modification	C:\Program Files\mrsmajor\CPUUsage.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\def_resource\creepysound.mp3	wscript.exe
File created	C:\Program Files\mrsmajor\reStart.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\CPUUsage.vbs	wscript.exe
File created	C:\Program Files\mrsmajor\def_resource\@Tile@@.jpg	wscript.exe
File created	C:\Program Files\mrsmajor\def_resource\Skullcur.cur	wscript.exe
File created	C:\Program Files\mrsmajor\Icon_resource\SkullIco.ico	wscript.exe
File created	C:\Program Files\mrsmajor\WinLogon.bat	wscript.exe
File created	C:\Program Files\mrsmajor\Doll_patch.xml	wscript.exe
File created	C:\Program Files\mrsmajor\default.txt	wscript.exe
File created	C:\Program Files\mrsmajor\def_resource\f11.mp4	wscript.exe

Drops file in Windows directory 3 IoCs

Processes:

svchost.exeBonzify.exe

description	ioc	process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\executables.bin	Bonzify.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
defense_evasion privilege_escalation

Create Process with Token
T1134.002

Processes:

wscript.exe

pid process

2728 wscript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2728	wscript.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

5712 taskkill.exe

pid	process
5712	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Cursors	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Cursors\Arrow = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Cursors\AppStarting = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Cursors\Hand = "C:\\Program Files\\mrsmajor\\def_resource\\skullcur.cur"	wscript.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "205"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 12 IoCs

Processes:

wscript.exewmplayer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-200405930-3877336739-3533750831-1000\{B0760462-9B4D-448E-B06A-E37043D1F044}	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp4file\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\DefaultIcon\ = "C:\\Program Files\\mrsmajor\\Icon_resource\\SkullIco.ico"	wscript.exe

NTFS ADS 2 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\BossDaMajor.exe:Zone.Identifier firefox.exe
File created C:\Users\Admin\Downloads\Bonzify.exe:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\BossDaMajor.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Bonzify.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

firefox.exeunregmp2.exewmplayer.exeAUDIODG.EXEtaskkill.exeshutdown.exe

description	pid	process
Token: SeDebugPrivilege	3160	firefox.exe
Token: SeDebugPrivilege	3160	firefox.exe
Token: SeDebugPrivilege	3160	firefox.exe
Token: SeDebugPrivilege	3160	firefox.exe
Token: SeDebugPrivilege	3160	firefox.exe
Token: SeShutdownPrivilege	5072	unregmp2.exe
Token: SeCreatePagefilePrivilege	5072	unregmp2.exe
Token: SeShutdownPrivilege	5532	wmplayer.exe
Token: SeCreatePagefilePrivilege	5532	wmplayer.exe
Token: 33	5284	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5284	AUDIODG.EXE
Token: SeShutdownPrivilege	5532	wmplayer.exe
Token: SeCreatePagefilePrivilege	5532	wmplayer.exe
Token: SeDebugPrivilege	5712	taskkill.exe
Token: SeShutdownPrivilege	2480	shutdown.exe
Token: SeRemoteShutdownPrivilege	2480	shutdown.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

firefox.exewmplayer.exe

pid process

3160 firefox.exe
3160 firefox.exe
3160 firefox.exe
3160 firefox.exe
5532 wmplayer.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

3160 firefox.exe
3160 firefox.exe
3160 firefox.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

firefox.exeBonzify.exeLogonUI.exe

pid process

3160 firefox.exe
3160 firefox.exe
3160 firefox.exe
3160 firefox.exe
3160 firefox.exe
3160 firefox.exe
3160 firefox.exe
3676 Bonzify.exe
2412 LogonUI.exe

pid	process
3160	firefox.exe
3160	firefox.exe
3160	firefox.exe
3160	firefox.exe
5532	wmplayer.exe

pid	process
3160	firefox.exe
3160	firefox.exe
3160	firefox.exe

pid	process
3160	firefox.exe
3160	firefox.exe
3160	firefox.exe
3160	firefox.exe
3160	firefox.exe
3160	firefox.exe
3160	firefox.exe
3676	Bonzify.exe
2412	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 888 wrote to memory of 3160	888	firefox.exe	firefox.exe
PID 888 wrote to memory of 3160	888	firefox.exe	firefox.exe
PID 888 wrote to memory of 3160	888	firefox.exe	firefox.exe
PID 888 wrote to memory of 3160	888	firefox.exe	firefox.exe
PID 888 wrote to memory of 3160	888	firefox.exe	firefox.exe
PID 888 wrote to memory of 3160	888	firefox.exe	firefox.exe
PID 888 wrote to memory of 3160	888	firefox.exe	firefox.exe
PID 888 wrote to memory of 3160	888	firefox.exe	firefox.exe
PID 888 wrote to memory of 3160	888	firefox.exe	firefox.exe
PID 888 wrote to memory of 3160	888	firefox.exe	firefox.exe
PID 888 wrote to memory of 3160	888	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 5104	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 620	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 620	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 620	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 620	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 620	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 620	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 620	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 620	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 620	3160	firefox.exe	firefox.exe
PID 3160 wrote to memory of 620	3160	firefox.exe	firefox.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://google.com"
1⤵
- Suspicious use of WriteProcessMemory
PID:888

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://google.com
2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3160.0.1440679397\133061230" -parentBuildID 20230214051806 -prefsHandle 1788 -prefMapHandle 1784 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6bdb8f3f-4bd9-4777-9bf9-04085290e366} 3160 "\\.\pipe\gecko-crash-server-pipe.3160" 1860 1dfbc00e358 gpu
3⤵
PID:5104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3160.1.1243304402\2058297944" -parentBuildID 20230214051806 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55bac0a9-d940-48e5-aa82-8bdbc99b3827} 3160 "\\.\pipe\gecko-crash-server-pipe.3160" 2452 1dfa7e88a58 socket
3⤵
PID:620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3160.2.1015157579\1191720716" -childID 1 -isForBrowser -prefsHandle 3044 -prefMapHandle 3100 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a998b81b-0e79-4009-8e52-954864c446e5} 3160 "\\.\pipe\gecko-crash-server-pipe.3160" 3088 1dfbef4b558 tab
3⤵
PID:2948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3160.3.470806360\1313824128" -childID 2 -isForBrowser -prefsHandle 3652 -prefMapHandle 3648 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5956048d-890b-4987-89c6-6ca4eec61b3b} 3160 "\\.\pipe\gecko-crash-server-pipe.3160" 3664 1dfa7e7ae58 tab
3⤵
PID:4368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3160.4.1388831841\849853913" -childID 3 -isForBrowser -prefsHandle 4900 -prefMapHandle 4928 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f3495cd-82e0-4af1-b780-a071ba26143e} 3160 "\\.\pipe\gecko-crash-server-pipe.3160" 4916 1dfc2628858 tab
3⤵
PID:2152

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3160.5.1412920333\1091834214" -childID 4 -isForBrowser -prefsHandle 2980 -prefMapHandle 4868 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {810b477e-63d5-41f6-a742-a69af7590d6e} 3160 "\\.\pipe\gecko-crash-server-pipe.3160" 2828 1dfc2e32758 tab
3⤵
PID:4312

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3160.6.206178809\541951376" -childID 5 -isForBrowser -prefsHandle 5464 -prefMapHandle 5460 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8149c565-58f9-4d78-ba40-d1deffb9a5c7} 3160 "\\.\pipe\gecko-crash-server-pipe.3160" 5472 1dfc2e33358 tab
3⤵
PID:2328

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3160.7.1771888182\949673190" -childID 6 -isForBrowser -prefsHandle 5584 -prefMapHandle 5592 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {495047ad-d5ff-4a43-a960-5bb42b80cecb} 3160 "\\.\pipe\gecko-crash-server-pipe.3160" 5580 1dfc2e33c58 tab
3⤵
PID:1840

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3160.8.1716742389\655725462" -parentBuildID 20230214051806 -prefsHandle 2724 -prefMapHandle 5916 -prefsLen 27776 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d64f3c4c-040e-40d0-b3c4-824f2c0dfe7d} 3160 "\\.\pipe\gecko-crash-server-pipe.3160" 3020 1dfc4a03e58 rdd
3⤵
PID:5644

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3160.9.2145268064\1711261164" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 6140 -prefMapHandle 6136 -prefsLen 27776 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb27af7d-d93d-4e15-bf49-cd3c24cf90ca} 3160 "\\.\pipe\gecko-crash-server-pipe.3160" 3104 1dfc4a06858 utility
3⤵
PID:5660

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3160.10.1961569137\372066242" -childID 7 -isForBrowser -prefsHandle 5176 -prefMapHandle 4876 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6848d70-4256-4a89-9337-e4110cccb574} 3160 "\\.\pipe\gecko-crash-server-pipe.3160" 10132 1dfa7e3f758 tab
3⤵
PID:5856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:688

C:\Users\Admin\Downloads\BossDaMajor.exe
"C:\Users\Admin\Downloads\BossDaMajor.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3672

C:\Windows\system32\wscript.exe
"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\9ED6.tmp\9ED7.vbs
2⤵
- Checks computer location settings
- Drops file in Program Files directory
PID:6092

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe"
3⤵
PID:5808

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Program files\mrsmajor\mrsmajorlauncher.vbs" RunAsAdministrator
3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Access Token Manipulation: Create Process with Token
- Modifies Control Panel
- Modifies registry class
- System policy modification
PID:2728

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" "C:\Program Files\mrsmajor\def_resource\f11.mp4"
4⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5532

C:\Windows\SysWOW64\unregmp2.exe
"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
5⤵
PID:5620

C:\Windows\system32\unregmp2.exe
"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
6⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\System32\shutdown.exe
"C:\Windows\System32\shutdown.exe" -r -t 03
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1544

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4 0x244
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5284

C:\Users\Admin\Downloads\Bonzify.exe
"C:\Users\Admin\Downloads\Bonzify.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3676

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
2⤵
PID:5432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im AgentSvr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5712

C:\Windows\SysWOW64\takeown.exe
takeown /r /d y /f C:\Windows\MsAgent
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6020

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6104

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa393b855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2412

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Modify Registry

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

File and Directory Permissions Modification

T1222

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

Query Registry

System Information Discovery