milleniumrat | hxxps://github[.]com/prometeydev/Prometheus/archive/refs/heads/main[.]zip

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	main.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	python-3.12.2-amd64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	s.exe

Executes dropped EXE 24 IoCs

pid	Process
2004	python-3.12.2-amd64.exe
3572	python-3.12.2-amd64.exe
3272	python-3.12.2-amd64.exe
4440	python.exe
3448	python.exe
1448	python.exe
5096	python.exe
404	python.exe
3124	python.exe
2040	python.exe
3604	python.exe
4500	python.exe
2312	python.exe
4112	python.exe
4328	python.exe
2572	py.exe
2872	python.exe
3184	py.exe
2164	python.exe
2472	s.exe
1640	main.exe
1008	setup.exe
1904	Update.exe
4540	s.exe

Loads dropped DLL 64 IoCs

pid	Process
3572	python-3.12.2-amd64.exe
3652	MsiExec.exe
4440	python.exe
4440	python.exe
4440	python.exe
4440	python.exe
4440	python.exe
4440	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
3448	python.exe
1448	python.exe
1448	python.exe
5096	python.exe
5096	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
404	python.exe
3124	python.exe
3124	python.exe
2040	python.exe
2040	python.exe
2040	python.exe
2040	python.exe
2040	python.exe
2040	python.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChromeUpdateLog\\Update.exe"	reg.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
115	3048	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
133	raw.githubusercontent.com
134	raw.githubusercontent.com
138	raw.githubusercontent.com
147	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
131	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1008 set thread context of 3780	1008	setup.exe	211

Drops file in Windows directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5b3d15.msi	msiexec.exe
File created	C:\Windows\Installer\e5b3d1f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{94087C99-E4F5-4637-A789-3B6059DF787B}	msiexec.exe
File created	C:\Windows\Installer\e5b3d37.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b3d1a.msi	msiexec.exe
File created	C:\Windows\Installer\e5b3d19.msi	msiexec.exe
File created	C:\Windows\Installer\e5b3d29.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FA5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA1E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D552469C-E810-468F-A139-1EA43D0E2BE0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4294.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b3d1e.msi	msiexec.exe
File created	C:\Windows\Installer\e5b3d2e.msi	msiexec.exe
File created	C:\Windows\Installer\e5b3d41.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8A6.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b3d3c.msi	msiexec.exe
File created	C:\Windows\Installer\e5b3d3d.msi	msiexec.exe
File created	C:\Windows\Installer\e5b3d42.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}	msiexec.exe
File created	C:\Windows\Installer\e5b3d38.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b3d38.msi	msiexec.exe
File created	C:\Windows\pyshellext.amd64.dll	msiexec.exe
File created	C:\Windows\pyw.exe	msiexec.exe
File created	C:\Windows\Installer\e5b3d24.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b3d24.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8FA0.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b3d28.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b3d29.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI518A.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3B36061E-A25F-4E12-BFD1-68E724723D48}	msiexec.exe
File created	C:\Windows\Installer\e5b3d46.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b3d2e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DAD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{3B36061E-A25F-4E12-BFD1-68E724723D48}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b3d42.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FE4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b3d33.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5b3d23.msi	msiexec.exe
File created	C:\Windows\Installer\e5b3d33.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI45A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIADCA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BD32BDE9-835D-4013-8F9A-45FF11456F02}	msiexec.exe
File created	C:\Windows\Installer\e5b3d32.msi	msiexec.exe
File created	C:\Windows\py.exe	msiexec.exe
File created	C:\Windows\Installer\{3B36061E-A25F-4E12-BFD1-68E724723D48}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b3d3d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BDE73EDC-76AE-475D-8885-9B583631B0FC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD2D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b3d15.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4534F2ED-1616-434D-98A6-0DA358DCD466}	msiexec.exe
File created	C:\Windows\Installer\e5b3d1a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b3d1f.msi	msiexec.exe
File created	C:\Windows\Installer\e5b3d2d.msi	msiexec.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3364	sc.exe
4088	sc.exe
2164	sc.exe
8	sc.exe
3872	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000486acc2d320b21400000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000486acc2d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900486acc2d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d486acc2d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000486acc2d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Update.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1572	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1560	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1344	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133562947246249946"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E16063B3F52A21E4FB1D867E4227D384\AssociateFiles	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\ = "{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\DisplayName = "Python 3.12.2 Standard Library (64-bit)"	python-3.12.2-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyzw	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\ = "{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E16063B3F52A21E4FB1D867E4227D384\ProductIcon = "C:\\Windows\\Installer\\{3B36061E-A25F-4E12-BFD1-68E724723D48}\\ARPIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{D552469C-E810-468F-A139-1EA43D0E2BE0}\DisplayName = "Python 3.12.2 Add to Path (64-bit)"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{BD32BDE9-835D-4013-8F9A-45FF11456F02}\DisplayName = "Python 3.12.2 Documentation (64-bit)"	python-3.12.2-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shellex	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Python.NoConFile\Shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyw\Content Type = "text/x-python"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Python.File\Shell\editwithidle\shell\edit312	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConFile	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}\ = "{94087C99-E4F5-4637-A789-3B6059DF787B}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E16063B3F52A21E4FB1D867E4227D384\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{3B36061E-A25F-4E12-BFD1-68E724723D48}v3.12.2150.0\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Python.NoConFile\Shell\editwithidle\Subcommands	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Python.File\Shell\editwithidle\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Python.NoConFile\Shell\editwithidle\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyz\Content Type = "application/x-zip-compressed"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E16063B3F52A21E4FB1D867E4227D384\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{3B36061E-A25F-4E12-BFD1-68E724723D48}v3.12.2150.0\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.Extension\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{BD32BDE9-835D-4013-8F9A-45FF11456F02}\ = "{BD32BDE9-835D-4013-8F9A-45FF11456F02}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Python.NoConFile\Shell\editwithidle	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.File\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\ = "Python Zip Application File (no console)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{D552469C-E810-468F-A139-1EA43D0E2BE0}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.File\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyw	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyc	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E16063B3F52A21E4FB1D867E4227D384\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E16063B3F52A21E4FB1D867E4227D384\SourceList\PackageName = "launcher.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CE0A86B13DD4431548E03758B480361F\E16063B3F52A21E4FB1D867E4227D384	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Windows\\py.exe\" \"%L\" %*"	msiexec.exe
Key created	\Registry\User\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\CPython-3.12	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.Extension\ = "Python Extension Module"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.ArchiveFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	python-3.12.2-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.File\shellex\DropHandler	msiexec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1768	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3000	chrome.exe
3000	chrome.exe
2636	chrome.exe
2636	chrome.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
3048	msiexec.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1640	main.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe
1904	Update.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe
Token: SeShutdownPrivilege	3000	chrome.exe
Token: SeCreatePagefilePrivilege	3000	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
2080	OpenWith.exe
2080	OpenWith.exe
2080	OpenWith.exe
2080	OpenWith.exe
2080	OpenWith.exe
2080	OpenWith.exe
2080	OpenWith.exe
2080	OpenWith.exe
2080	OpenWith.exe
2080	OpenWith.exe
2080	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3684	3000	chrome.exe	86
PID 3000 wrote to memory of 3684	3000	chrome.exe	86
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 2616	3000	chrome.exe	91
PID 3000 wrote to memory of 4904	3000	chrome.exe	92
PID 3000 wrote to memory of 4904	3000	chrome.exe	92
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93
PID 3000 wrote to memory of 4600	3000	chrome.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1328	attrib.exe
2324	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/prometeydev/Prometheus/archive/refs/heads/main.zip
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xbc,0x108,0x7ffb261d9758,0x7ffb261d9768,0x7ffb261d9778
    3⤵
    PID:3684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:2
    3⤵
    PID:2616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:4904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:4600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:1
    3⤵
    PID:3356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:1756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:4784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1752 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5260 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:2988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:5096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1588 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5300 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:1
    3⤵
    PID:4824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3972 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6664 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:4512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6632 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:1800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:3736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6940 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3288 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:4272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7164 --field-trial-handle=1948,i,2329391699061436793,16775126369306060926,131072 /prefetch:8
    3⤵
    PID:2560
- - C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
    "C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"
    3⤵
    - Executes dropped EXE
    PID:2004
  - - C:\Windows\Temp\{3E3F0ACE-2056-4368-8B53-2877CA5AAA34}\.cr\python-3.12.2-amd64.exe
      "C:\Windows\Temp\{3E3F0ACE-2056-4368-8B53-2877CA5AAA34}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=584
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Modifies registry class
      PID:3572
    - - C:\Windows\Temp\{FFDE8890-4941-4AA1-B3F6-324F5D2B592F}\.be\python-3.12.2-amd64.exe
        
        "C:\Windows\Temp\{FFDE8890-4941-4AA1-B3F6-324F5D2B592F}\.be\python-3.12.2-amd64.exe" -q -burn.elevated BurnPipe.{E6F6F6CB-135E-4087-AEAA-4F8C27EB62FC} {B6C5274A-F92A-4762-BAC8-E3CAEC77C48F} 3572
        5⤵
        Executes dropped EXE
        
        PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\Builder.bat" "
  2⤵
  PID:364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\Builder.bat" "
  2⤵
  PID:2936
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    python --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1448
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    python -c "import customtkinter"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5096
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    python -m pip install customtkinter
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:404
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    python -c "import PIL"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3124
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    python -m pip install pillow
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2040
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    python -c "import pyaes"
    3⤵
    - Executes dropped EXE
    PID:3604
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    python -m pip install pyaesm
    3⤵
    - Executes dropped EXE
    PID:4500
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    python -c "import urllib3"
    3⤵
    - Executes dropped EXE
    PID:2312
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    python -m pip install urllib3
    3⤵
    - Executes dropped EXE
    PID:4112
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    python gui.py
    3⤵
    - Executes dropped EXE
    PID:4328
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\gui.py"
  2⤵
  - Executes dropped EXE
  PID:2572
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\gui.py"
    3⤵
    - Executes dropped EXE
    PID:2872
- C:\Windows\py.exe
  "C:\Windows\py.exe" "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\Extras\unblock_sites.py"
  2⤵
  - Executes dropped EXE
  PID:3184
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\Extras\unblock_sites.py"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    PID:2164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
      4⤵
      PID:3360
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        5⤵
        
        PID:4912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:1296
    - - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        5⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:1328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:4328
    - - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        5⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:2324
- C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\RarExtInstaller.exe
  "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\RarExtInstaller.exe"
  2⤵
  PID:4008
- C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exe
  "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exe"
  2⤵
  PID:2572
- - C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exe
    "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exe"
    3⤵
    PID:2980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI25722\s.exe -pbeznogym
      4⤵
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\_MEI25722\s.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI25722\s.exe -pbeznogym
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2472
      - C:\ProgramData\main.exe
        
        "C:\ProgramData\main.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp9609.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp9609.tmp.bat
        7⤵
        
        PID:4940
        
        C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1640"
        8⤵
        Enumerates processes with tasklist
        
        PID:1344
        
        C:\Windows\system32\find.exe
        
        find ":"
        8⤵
        
        PID:2956
        
        C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        8⤵
        Delays execution with timeout.exe
        
        PID:1560
        
        C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
        
        "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
        9⤵
        
        PID:3316
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
        10⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1768
      - C:\ProgramData\setup.exe
        
        "C:\ProgramData\setup.exe"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:1556
- C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exe
  "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exe"
  2⤵
  PID:4912
- - C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exe
    "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\hacn.exe"
    3⤵
    PID:4828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI49122\s.exe -pbeznogym
      4⤵
      PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\_MEI49122\s.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI49122\s.exe -pbeznogym
        5⤵
        Executes dropped EXE
        
        PID:4540
      - C:\ProgramData\main.exe
        
        "C:\ProgramData\main.exe"
        6⤵
        
        PID:2376
      - C:\ProgramData\setup.exe
        
        "C:\ProgramData\setup.exe"
        6⤵
        
        PID:1580
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:788
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3364
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4088
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2164
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:8
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3872
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:3780
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:3656
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\yntnomxcupkb.xml"
  2⤵
  - Creates scheduled task(s)
  PID:1572
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:3504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:2984
- C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\Rar.exe
  "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\Rar.exe"
  2⤵
  PID:756
- C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\Rar.exe
  "C:\Users\Admin\Downloads\Prometheus-main\Prometheus-main\Prometheus\env\Scripts\dist\Rar.exe"
  2⤵
  PID:4360

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2656

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4980

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2532

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1868

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 674803F6B567E544B8DE2268BCA98C6B
  2⤵
  - Loads dropped DLL
  PID:3652
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4440
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp3tl3i3l6\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp3tl3i3l6', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:444

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery