dcrat | hxxps://zelenka[.]guru/proxy[.]php?link=https%3A%2F%2Fdisk[.]yandex[.]ru%2Fd%2FGgnVcFAK2iaoyg&hash=525565395fc528e32c70d575456a1c39

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	MsWebreview.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	GrexClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 22 IoCs

pid	Process
2160	GrexClient.exe
3348	MsWebreview.exe
1520	lsass.exe
3340	MsWebreview.exe
3628	lsass.exe
4808	csrss.exe
3964	services.exe
756	lsass.exe
4852	csrss.exe
4260	dwm.exe
2704	chrome.exe
3788	sppsvc.exe
1304	cmd.exe
2172	lsass.exe
5048	csrss.exe
3964	services.exe
4068	lsass.exe
1692	csrss.exe
2360	dwm.exe
4028	chrome.exe
3060	sppsvc.exe
3656	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\de-DE\7a73b78f679a6f	MsWebreview.exe
File created	C:\Program Files\Windows Multimedia Platform\6cb0b6c459d5d3	MsWebreview.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\chrome.exe	MsWebreview.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\7a73b78f679a6f	MsWebreview.exe
File created	C:\Program Files\Windows Multimedia Platform\dwm.exe	MsWebreview.exe
File created	C:\Program Files\Windows Defender\de-DE\chrome.exe	MsWebreview.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\chrome.exe	MsWebreview.exe
File created	C:\Program Files (x86)\Google\Temp\csrss.exe	MsWebreview.exe
File created	C:\Program Files (x86)\Google\Temp\886983d96e3d3e	MsWebreview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4540	schtasks.exe
4420	schtasks.exe
3280	schtasks.exe
2388	schtasks.exe
1376	schtasks.exe
1040	schtasks.exe
4780	schtasks.exe
3704	schtasks.exe
560	schtasks.exe
4880	schtasks.exe
1460	schtasks.exe
3064	schtasks.exe
2068	schtasks.exe
1888	schtasks.exe
704	schtasks.exe
2992	schtasks.exe
4604	schtasks.exe
2952	schtasks.exe
4024	schtasks.exe
2904	schtasks.exe
2200	schtasks.exe
4792	schtasks.exe
3292	schtasks.exe
2188	schtasks.exe
2304	schtasks.exe
1532	schtasks.exe
3020	schtasks.exe
4608	schtasks.exe
4532	schtasks.exe
4084	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133504072818929036"	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	GrexClient.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2532	reg.exe
4612	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1844	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4340	chrome.exe
4340	chrome.exe
3348	MsWebreview.exe
3348	MsWebreview.exe
3348	MsWebreview.exe
3348	MsWebreview.exe
1520	lsass.exe
1520	lsass.exe
3928	chrome.exe
3928	chrome.exe
1520	lsass.exe
1520	lsass.exe
1520	lsass.exe
1520	lsass.exe
1520	lsass.exe
1520	lsass.exe
1520	lsass.exe
1520	lsass.exe
1520	lsass.exe
1520	lsass.exe
1520	lsass.exe
1520	lsass.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1484	7zFM.exe
1520	lsass.exe
2888	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
1484	7zFM.exe
2704	7zG.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4480	7zG.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2160	GrexClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 3236	4340	chrome.exe	85
PID 4340 wrote to memory of 3236	4340	chrome.exe	85
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1428	4340	chrome.exe	88
PID 4340 wrote to memory of 1388	4340	chrome.exe	89
PID 4340 wrote to memory of 1388	4340	chrome.exe	89
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90
PID 4340 wrote to memory of 4636	4340	chrome.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zelenka.guru/proxy.php?link=https%3A%2F%2Fdisk.yandex.ru%2Fd%2FGgnVcFAK2iaoyg&hash=525565395fc528e32c70d575456a1c39
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcae169758,0x7ffcae169768,0x7ffcae169778
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:2
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1592 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5504 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\GrexClient.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4728 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5160 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6120 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3284 --field-trial-handle=1876,i,7357306286202951702,17542600918457111041,131072 /prefetch:8
  2⤵
  PID:3092

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:560

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap6980:82:7zEvent32176
1⤵
- Suspicious use of FindShellTrayWindow
PID:2704

C:\Users\Admin\Downloads\GrexClient.exe
"C:\Users\Admin\Downloads\GrexClient.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2160
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Hyperagentwebsessionhost\sCDaCT5RiV0ZmI47PN4hzdO5i.vbe"
  2⤵
  - Checks computer location settings
  PID:1612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Hyperagentwebsessionhost\xgHODI7d8tvl5y0vdAAvQ1c.bat" "
    3⤵
    PID:4512
  - - C:\Hyperagentwebsessionhost\MsWebreview.exe
      "C:\Hyperagentwebsessionhost\MsWebreview.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      PID:3348
    - - C:\Recovery\WindowsRE\lsass.exe
        
        "C:\Recovery\WindowsRE\lsass.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:1520
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\de-DE\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\de-DE\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Temp\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Temp\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 11 /tr "'C:\Hyperagentwebsessionhost\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Hyperagentwebsessionhost\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 12 /tr "'C:\Hyperagentwebsessionhost\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Documents\My Pictures\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Pictures\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Documents\My Pictures\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Hyperagentwebsessionhost\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Hyperagentwebsessionhost\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Hyperagentwebsessionhost\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap25809:82:7zEvent23960
1⤵
- Suspicious use of FindShellTrayWindow
PID:4480

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\xgHODI7d8tvl5y0vdAAvQ1c.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:1844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\xgHODI7d8tvl5y0vdAAvQ1c.bat" "
1⤵
PID:1548
- C:\Hyperagentwebsessionhost\MsWebreview.exe
  "C:\Hyperagentwebsessionhost\MsWebreview.exe"
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4612

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2888

C:\Recovery\WindowsRE\lsass.exe
C:\Recovery\WindowsRE\lsass.exe
1⤵
- Executes dropped EXE
PID:3628

C:\Program Files (x86)\Google\Temp\csrss.exe
"C:\Program Files (x86)\Google\Temp\csrss.exe"
1⤵
- Executes dropped EXE
PID:4808

C:\Hyperagentwebsessionhost\services.exe
C:\Hyperagentwebsessionhost\services.exe
1⤵
- Executes dropped EXE
PID:3964

C:\Recovery\WindowsRE\lsass.exe
C:\Recovery\WindowsRE\lsass.exe
1⤵
- Executes dropped EXE
PID:756

C:\Program Files (x86)\Google\Temp\csrss.exe
"C:\Program Files (x86)\Google\Temp\csrss.exe"
1⤵
- Executes dropped EXE
PID:4852

C:\Program Files\Windows Multimedia Platform\dwm.exe
"C:\Program Files\Windows Multimedia Platform\dwm.exe"
1⤵
- Executes dropped EXE
PID:4260

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\chrome.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\chrome.exe"
1⤵
- Executes dropped EXE
PID:2704

C:\Users\Default User\sppsvc.exe
"C:\Users\Default User\sppsvc.exe"
1⤵
- Executes dropped EXE
PID:3788

C:\Recovery\WindowsRE\cmd.exe
C:\Recovery\WindowsRE\cmd.exe
1⤵
- Executes dropped EXE
PID:1304

C:\Recovery\WindowsRE\lsass.exe
C:\Recovery\WindowsRE\lsass.exe
1⤵
- Executes dropped EXE
PID:2172

C:\Program Files (x86)\Google\Temp\csrss.exe
"C:\Program Files (x86)\Google\Temp\csrss.exe"
1⤵
- Executes dropped EXE
PID:5048

C:\Hyperagentwebsessionhost\services.exe
C:\Hyperagentwebsessionhost\services.exe
1⤵
- Executes dropped EXE
PID:3964

C:\Recovery\WindowsRE\lsass.exe
C:\Recovery\WindowsRE\lsass.exe
1⤵
- Executes dropped EXE
PID:4068

C:\Program Files (x86)\Google\Temp\csrss.exe
"C:\Program Files (x86)\Google\Temp\csrss.exe"
1⤵
- Executes dropped EXE
PID:1692

C:\Program Files\Windows Multimedia Platform\dwm.exe
"C:\Program Files\Windows Multimedia Platform\dwm.exe"
1⤵
- Executes dropped EXE
PID:2360

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\chrome.exe
"C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\chrome.exe"
1⤵
- Executes dropped EXE
PID:4028

C:\Users\Default User\sppsvc.exe
"C:\Users\Default User\sppsvc.exe"
1⤵
- Executes dropped EXE
PID:3060

C:\Recovery\WindowsRE\cmd.exe
C:\Recovery\WindowsRE\cmd.exe
1⤵
- Executes dropped EXE
PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery