hxxps://o-cs[.]ru/load/sborki_cs_1_6/russkaja_versija_ks_1_6/335-1-0-162

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\cdcbdd9f\ImagePath = "System32\\Drivers\\cdcbdd9f.sys"	099733e7.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_cdcbdd9fa_arkmon\ImagePath = "System32\\Drivers\\klupd_cdcbdd9fa_arkmon.sys"	099733e7.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_cdcbdd9fa_klbg\ImagePath = "System32\\Drivers\\klupd_cdcbdd9fa_klbg.sys"	099733e7.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_cdcbdd9fa_klark\ImagePath = "System32\\Drivers\\klupd_cdcbdd9fa_klark.sys"	099733e7.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_cdcbdd9fa_mark\ImagePath = "System32\\Drivers\\klupd_cdcbdd9fa_mark.sys"	099733e7.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_cdcbdd9fa_arkmon_3EAA902C\ImagePath = "\\??\\C:\\KVRT2020_Data\\Temp\\3EAA902C0B5097D0258FD5FE1D8A2AA9\\klupd_cdcbdd9fa_arkmon.sys"	099733e7.exe

Executes dropped EXE 11 IoCs

pid	Process
1232	Counter-Strike-classic.exe
1404	nost.exe
3720	nost.exe
5308	run.exe
392	nost.exe
2440	nost.exe
1216	nost.exe
3796	nost.exe
2616	nost.exe
5360	KVRT.exe
4560	099733e7.exe

Loads dropped DLL 57 IoCs

pid	Process
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
5308	run.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\e2ec8637-1387-4a47-adca-20b673a44383 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\{a1041049-f3d4-4c9a-baee-be862ee4e28a}\\e2ec8637-1387-4a47-adca-20b673a44383.cmd\""	099733e7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	099733e7.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	run.exe
File opened for modification	\??\PhysicalDrive0	099733e7.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	KVRT.exe
File opened (read-only)	\??\VBoxMiniRdrDN	099733e7.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	\??\c:\windows\Media\nost.exe	Counter-Strike-classic.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4464	sc.exe
3000	sc.exe
3212	sc.exe
2216	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4216	1232	WerFault.exe	93

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133425433568554295"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	nost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings	taskmgr.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4560	099733e7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1856	chrome.exe
1856	chrome.exe
3476	chrome.exe
3476	chrome.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe
3720	nost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4560	099733e7.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe
4560	099733e7.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe
Token: SeShutdownPrivilege	1856	chrome.exe
Token: SeCreatePagefilePrivilege	1856	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
1856	chrome.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe
4184	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1232	Counter-Strike-classic.exe
1232	Counter-Strike-classic.exe
1404	nost.exe
5308	run.exe
5308	run.exe
5360	KVRT.exe
4560	099733e7.exe
4560	099733e7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 752	1856	chrome.exe	71
PID 1856 wrote to memory of 752	1856	chrome.exe	71
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 688	1856	chrome.exe	74
PID 1856 wrote to memory of 4780	1856	chrome.exe	73
PID 1856 wrote to memory of 4780	1856	chrome.exe	73
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75
PID 1856 wrote to memory of 4852	1856	chrome.exe	75

Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://o-cs.ru/load/sborki_cs_1_6/russkaja_versija_ks_1_6/335-1-0-162
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffef5da9758,0x7ffef5da9768,0x7ffef5da9778
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:2
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4556 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4888 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4164 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4688 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5192 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6512 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6444 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6864 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6516 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4288 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5752 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5756 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:4968
- C:\Users\Admin\Downloads\Counter-Strike-classic.exe
  "C:\Users\Admin\Downloads\Counter-Strike-classic.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1232
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C sc query service5
    3⤵
    PID:4212
  - - C:\Windows\SysWOW64\sc.exe
      sc query service5
      4⤵
      Launches sc.exe
      PID:4464
- - C:\Windows\Media\nost.exe
    "C:\Windows\Media\nost.exe" /install /silent
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1404
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" failure service5 reset= 0 actions= restart/0/restart/0/restart/0
    3⤵
    - Launches sc.exe
    PID:3000
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" description "<Error Code: 15100>" "Service will attempt to resolve local names in Windows environment."
    3⤵
    - Launches sc.exe
    PID:3212
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start service5
    3⤵
    PID:4480
  - - C:\Windows\SysWOW64\net.exe
      net start service5
      4⤵
      PID:2708
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start service5
        5⤵
        
        PID:2852
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" failure service5 reset= 0 actions= restart/0/restart/0/restart/0
    3⤵
    - Launches sc.exe
    PID:2216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 1448
    3⤵
    - Program crash
    PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cd "c:/game/cs16new_rus" && run.exe -game cstrike -32bpp -gl -w 1280 -h 720
    3⤵
    PID:6020
  - - \??\c:\game\cs16new_rus\run.exe
      run.exe -game cstrike -32bpp -gl -w 1280 -h 720
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Writes to the Master Boot Record (MBR)
      Suspicious use of SetWindowsHookEx
      PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=888 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5528 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5552 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4876 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5412 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5132 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=7124 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=7072 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6680 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4520 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6464 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6920 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5292 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:3352
- C:\Users\Admin\Downloads\KVRT.exe
  "C:\Users\Admin\Downloads\KVRT.exe"
  2⤵
  - Executes dropped EXE
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Suspicious use of SetWindowsHookEx
  PID:5360
- - C:\Users\Admin\AppData\Local\Temp\{5aef01d8-b939-43d1-9873-a5498825eca9}\099733e7.exe
    C:/Users/Admin/AppData/Local/Temp/{5aef01d8-b939-43d1-9873-a5498825eca9}/\099733e7.exe
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious behavior: LoadsDriver
    - Suspicious use of SetWindowsHookEx
    PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=6512 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=7220 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7196 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6980 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:8
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=7000 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6516 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=7476 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=8140 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=8040 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=7732 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=8136 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=8080 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=7300 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=7712 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=7916 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=5724 --field-trial-handle=1784,i,12376079071177682918,17152696725259643260,131072 /prefetch:1
  2⤵
  PID:5972

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4516

C:\Windows\Media\nost.exe
C:\Windows\Media\nost.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3720

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:4184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3884

C:\Windows\Media\nost.exe
C:\Windows\Media\nost.exe
1⤵
- Executes dropped EXE
PID:392

C:\Windows\Media\nost.exe
C:\Windows\Media\nost.exe
1⤵
- Executes dropped EXE
PID:2440

C:\Windows\Media\nost.exe
C:\Windows\Media\nost.exe
1⤵
- Executes dropped EXE
PID:1216

C:\Windows\Media\nost.exe
C:\Windows\Media\nost.exe
1⤵
- Executes dropped EXE
PID:3796

C:\Windows\Media\nost.exe
C:\Windows\Media\nost.exe
1⤵
- Executes dropped EXE
PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffef5da9758,0x7ffef5da9768,0x7ffef5da9778
  2⤵
  PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery