hxxps://bit[.]ly/triageshare2024

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	python-3.12.3-amd64.exe

Executes dropped EXE 43 IoCs

pid	Process
2152	python-3.12.3-amd64.exe
4156	python-3.12.3-amd64.exe
2968	python.exe
2908	python.exe
1240	py.exe
2308	python.exe
4912	python.exe
4284	pip.exe
2272	python.exe
4372	py.exe
1528	python.exe
5188	pyw.exe
1376	pythonw.exe
5236	py.exe
3448	python.exe
5004	python.exe
5592	py.exe
2716	python.exe
6092	python.exe
6012	python.exe
3760	python-3.12.3-amd64.exe
4308	python-3.12.3-amd64.exe
5552	python-3.12.3-amd64.exe
5172	python-3.12.3-amd64.exe
5516	python.exe
5656	python.exe
2160	python-3.12.3-amd64.exe
232	python-3.12.3-amd64.exe
3296	python-3.12.3-amd64.exe
5520	python.exe
1440	python.exe
5220	py.exe
5472	python.exe
5556	py.exe
6000	python.exe
2888	py.exe
2908	python.exe
3576	py.exe
5236	python.exe
4924	py.exe
6108	python.exe
388	py.exe
5884	python.exe

Loads dropped DLL 64 IoCs

pid	Process
4156	python-3.12.3-amd64.exe
3528	MsiExec.exe
2968	python.exe
2968	python.exe
2968	python.exe
2968	python.exe
2968	python.exe
2968	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2908	python.exe
2308	python.exe
2308	python.exe
4912	python.exe
4912	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
2272	python.exe
1528	python.exe
1528	python.exe
1528	python.exe
1528	python.exe
1528	python.exe
1528	python.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
178	3120	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.12\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com
534	drive.google.com
598	drive.google.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Python312\Lib\xml\sax\expatreader.py	msiexec.exe
File created	C:\Program Files\Python312\tcl\tix8.4.3\pref\TK.csc	msiexec.exe
File created	C:\Program Files\Python312\Lib\lib2to3\fixes\__pycache__\fix_print.cpython-312.pyc.2790109210800	python.exe
File created	C:\Program Files\Python312\Lib\__pycache__\smtplib.cpython-312.opt-2.pyc.1173564588336	python.exe
File created	C:\Program Files\Python312\Lib\calendar.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\encodings\cp1255.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\urllib3\contrib\_securetransport\__pycache__\bindings.cpython-312.pyc.1810747868768	python.exe
File created	C:\Program Files\Python312\Lib\encodings\__pycache__\cp857.cpython-312.pyc.2790107541424	python.exe
File created	C:\Program Files\Python312\Lib\test\test_asyncio\__pycache__\test_events.cpython-312.pyc.2790108947072	python.exe
File created	C:\Program Files\Python312\Lib\test\test_json\__pycache__\test_tool.cpython-312.pyc.2790145736112	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_configparser.cpython-312.opt-1.pyc.2301538940592	python.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\tzdata\Africa\Accra	msiexec.exe
File created	C:\Program Files\Python312\Lib\email\__pycache__\feedparser.cpython-312.pyc.1810734921008	python.exe
File created	C:\Program Files\Python312\Lib\test\test_cppext\__pycache__\setup.cpython-312.opt-1.pyc.2301528630064	python.exe
File created	C:\Program Files\Python312\Lib\test\test_importlib\builtin\__pycache__\__init__.cpython-312.opt-1.pyc.2301540382688	python.exe
File created	C:\Program Files\Python312\Lib\test\test_unittest\testmock\__pycache__\testsentinel.cpython-312.opt-1.pyc.2301529582736	python.exe
File created	C:\Program Files\Python312\Lib\test\test_email\data\python.pgm	msiexec.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\urllib3\packages\backports\__pycache__\weakref_finalize.cpython-312.pyc.1810747880032	python.exe
File created	C:\Program Files\Python312\Lib\turtledemo\__pycache__\forest.cpython-312.pyc.2790109132848	python.exe
File created	C:\Program Files\Python312\Lib\encodings\__pycache__\mac_cyrillic.cpython-312.opt-2.pyc.1173555319984	python.exe
File created	C:\Program Files\Python312\include\pystate.h	msiexec.exe
File created	C:\Program Files\Python312\Lib\idlelib\__main__.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\test_weakref.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\test_xxtestfuzz.py	msiexec.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\msgs\zh_cn.msg	msiexec.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\tzdata\Universal	msiexec.exe
File created	C:\Program Files\Python312\tcl\tk8.6\msgs\eo.msg	msiexec.exe
File created	C:\Program Files\Python312\Lib\encodings\ptcp154.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\encodings\shift_jisx0213.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_imghdr.cpython-312.opt-2.pyc.1173574349488	python.exe
File created	C:\Program Files\Python312\Lib\unittest\__pycache__\signals.cpython-312.opt-2.pyc.1173555353648	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_fnmatch.cpython-312.pyc.2790108518064	python.exe
File created	C:\Program Files\Python312\Lib\__pycache__\traceback.cpython-312.pyc.2790126122160	python.exe
File created	C:\Program Files\Python312\Lib\idlelib\__pycache__\filelist.cpython-312.pyc.2790107541936	python.exe
File created	C:\Program Files\Python312\Lib\lib2to3\__pycache__\main.cpython-312.opt-2.pyc.1173555314736	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\rich\__init__.py	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\urllib3\contrib\__pycache__\__init__.cpython-312.pyc.1810748272720	python.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\packaging\_manylinux.py	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_script_helper.cpython-312.opt-1.pyc.2301540382976	python.exe
File created	C:\Program Files\Python312\Lib\test\tokenizedata\tokenize_tests-utf8-coding-cookie-and-utf8-bom-sig.txt	msiexec.exe
File created	C:\Program Files\Python312\tcl\tcl8.6\msgs\es_cr.msg	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\test_dataclasses\__pycache__\__init__.cpython-312.opt-2.pyc.1173562880720	python.exe
File created	C:\Program Files\Python312\Lib\lib2to3\fixes\fix_types.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\test_zipfile\_path\__init__.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\idlelib\__pycache__\delegator.cpython-312.pyc.2790107541424	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_sundry.cpython-312.opt-2.pyc.1173596104624	python.exe
File created	C:\Program Files\Python312\Lib\test\lock_tests.py	msiexec.exe
File created	C:\Program Files\Python312\tcl\tix8.4.3\demos\samples\Meter.tcl	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_htmlparser.cpython-312.pyc.2790124699056	python.exe
File created	C:\Program Files\Python312\Lib\lib2to3\fixes\__pycache__\fix_reload.cpython-312.opt-1.pyc.2301529300480	python.exe
File created	C:\Program Files\Python312\Lib\test\certdata\capath\6e88d7b8.0	msiexec.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_internal\network\session.py	python.exe
File created	C:\Program Files\Python312\Lib\__pycache__\_pydatetime.cpython-312.opt-1.pyc.2301529371952	python.exe
File created	C:\Program Files\Python312\Lib\multiprocessing\__pycache__\process.cpython-312.opt-1.pyc.2301529307248	python.exe
File created	C:\Program Files\Python312\Lib\encodings\__pycache__\iso8859_16.cpython-312.opt-2.pyc.1173555318832	python.exe
File created	C:\Program Files\Python312\Lib\xml\sax\xmlreader.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\idlelib\window.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_c_locale_coercion.cpython-312.pyc.2790108518064	python.exe
File created	C:\Program Files\Python312\Lib\test\__pycache__\test_zlib.cpython-312.pyc.2790114079664	python.exe
File created	C:\Program Files\Python312\Lib\test\test_ctypes\__pycache__\test_macholib.cpython-312.opt-1.pyc.2301540379664	python.exe
File created	C:\Program Files\Python312\Lib\test\test_eof.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\site-packages\pip\_vendor\rich\__pycache__\prompt.cpython-312.pyc.1810769528416	python.exe
File created	C:\Program Files\Python312\Lib\test\test_peg_generator\test_pegen.py	msiexec.exe
File created	C:\Program Files\Python312\Lib\importlib\__pycache__\readers.cpython-312.pyc.1510482786224	python.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e654fe3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59bfb0.msi	msiexec.exe
File created	C:\Windows\Installer\e654fdf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e654fbe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e654fc2.msi	msiexec.exe
File created	C:\Windows\Installer\e654fd7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI59DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59bf8d.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9F2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8AB2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI460E.tmp	msiexec.exe
File created	C:\Windows\Installer\e654fd2.msi	msiexec.exe
File created	C:\Windows\Installer\e59bf9c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59bfa1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4803.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI19EA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{837260D6-3959-452B-A557-666302BEA663}	msiexec.exe
File created	C:\Windows\Installer\e654fe4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59bfa6.msi	msiexec.exe
File created	C:\Windows\Installer\e59bfb5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI818B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8566.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI43BB.tmp	msiexec.exe
File created	C:\Windows\Installer\e59bfa0.msi	msiexec.exe
File created	C:\Windows\Installer\e59bfa6.msi	msiexec.exe
File created	C:\Windows\Installer\e654fc3.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A2FC8FF0-021A-431C-826E-E4B85D3F064F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD83.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C0F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59bfab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2833.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{837260D6-3959-452B-A557-666302BEA663}	msiexec.exe
File opened for modification	C:\Windows\Installer\e654fdf.msi	msiexec.exe
File created	C:\Windows\Installer\e59bf92.msi	msiexec.exe
File created	C:\Windows\Installer\e59bf97.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	msiexec.exe
File created	C:\Windows\Installer\e654fdb.msi	msiexec.exe
File created	C:\Windows\Installer\e654fe8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI49A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e59bf92.msi	msiexec.exe
File created	C:\Windows\Installer\e59bfaa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\idle.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e654fe4.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36F0.tmp	msiexec.exe
File created	C:\Windows\Installer\e59bf96.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FE3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI325.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59bf9c.msi	msiexec.exe
File created	C:\Windows\Installer\e59bfb4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDFA.tmp	msiexec.exe
File created	C:\Windows\Installer\e59bfab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7270.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e654fcd.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{575FEF7A-71FE-437E-91B0-D3838C1026DA}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84C9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE999.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aac6c6add0ae26c00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aac6c6ad0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900aac6c6ad000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daac6c6ad000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000aac6c6ad00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133576948793003063"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\952F1BE8623138543B385F3C7D9CD3D7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\Shell\editwithidle\Subcommands	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\Shell\editwithidle\shell\edit312	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFED3BF868D49884B9A0F07EEA097D9C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}v3.12.3150.0\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.File\Shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D7C91534D075F640A9AA311D5372ECE\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.File\Shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.NoConArchiveFile\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\.py	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\.pyd\ = "Python.Extension"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2A62ACE542A62185592545C9B1852DD5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D0627389593B2545A75663620EB6A36\SourceList\PackageName = "pip.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}\Dependents	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}\DisplayName = "Python 3.12.3 pip Bootstrap (64-bit)"	python-3.12.3-amd64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2BE9381A03C3DCB4AAFC406FFFC609DC\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\0\NodeSlot = "7"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D7C91534D075F640A9AA311D5372ECE\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\952F1BE8623138543B385F3C7D9CD3D7\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}v3.12.3150.0\\"	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_CLASSES\INSTALLER\DEPENDENCIES\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\DEPENDENTS\{5EE4D2B6-A5DC-4321-B6BD-3EBC98120A51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A7FEF575EF17E734190B3D38C80162AD\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D0627389593B2545A75663620EB6A36\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.NoConArchiveFile\ = "Python Zip Application File (no console)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D7C91534D075F640A9AA311D5372ECE\DeploymentFlags = "2"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9785E4745D9A5FD43958DA7F2E42EC7C\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.File\shellex	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\DisplayName = "Python 3.12.3 Standard Library (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.CompiledFile\shellex	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\0	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}\ = "{575FEF7A-71FE-437E-91B0-D3838C1026DA}"	python-3.12.3-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.NoConFile\Shell\editwithidle\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\.pyo\ = "Python.CompiledFile"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\DisplayName = "Python 3.12.3 Tcl/Tk Support (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5F138CB615460F45D88B3EA8B2F22A35	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.File\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.Extension\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Installer\Dependencies\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}	python-3.12.3-amd64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\952F1BE8623138543B385F3C7D9CD3D7\Version = "51121230"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\952F1BE8623138543B385F3C7D9CD3D7\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D0627389593B2545A75663620EB6A36\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.NoConFile\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyw.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.Extension	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2BE9381A03C3DCB4AAFC406FFFC609DC\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2BE9381A03C3DCB4AAFC406FFFC609DC\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\Shell	msiexec.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
3404	NOTEPAD.EXE
5564	NOTEPAD.EXE
2356	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4484	chrome.exe
4484	chrome.exe
3556	chrome.exe
3556	chrome.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
3120	msiexec.exe
1300	powershell.exe
1300	powershell.exe
1300	powershell.exe
5184	powershell.exe
5184	powershell.exe
5184	powershell.exe
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe
3788	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1416	OpenWith.exe
368	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe
Token: SeShutdownPrivilege	4484	chrome.exe
Token: SeCreatePagefilePrivilege	4484	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4156	python-3.12.3-amd64.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe
4484	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1416	OpenWith.exe
1416	OpenWith.exe
1416	OpenWith.exe
1416	OpenWith.exe
1416	OpenWith.exe
1416	OpenWith.exe
1416	OpenWith.exe
1416	OpenWith.exe
1416	OpenWith.exe
1416	OpenWith.exe
1416	OpenWith.exe
1416	OpenWith.exe
1416	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
4312	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe
368	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3132	4484	chrome.exe	80
PID 4484 wrote to memory of 3132	4484	chrome.exe	80
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 1516	4484	chrome.exe	84
PID 4484 wrote to memory of 2700	4484	chrome.exe	85
PID 4484 wrote to memory of 2700	4484	chrome.exe	85
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86
PID 4484 wrote to memory of 1188	4484	chrome.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bit.ly/triageshare2024
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88b8aab58,0x7ff88b8aab68,0x7ff88b8aab78
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2124 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4220 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4456 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3296 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4872 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4860 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5188 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3220 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5388 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5436 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4868 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5732 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5648 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4928 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4816 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5964 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5980 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1160 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2880 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5860 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:736
- C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
  "C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:2152
- - C:\Windows\Temp\{0E414EB4-BE66-4BE7-9748-8772A4CCBF04}\.cr\python-3.12.3-amd64.exe
    "C:\Windows\Temp\{0E414EB4-BE66-4BE7-9748-8772A4CCBF04}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4156
- C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
  "C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\flytest.py"
  2⤵
  - Executes dropped EXE
  PID:1240
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\flytest.py"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4008 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5916 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1732 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4956 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=4868 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=2332 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=5500 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=5776 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=6136 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5772 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6764 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6748 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6656 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6596 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6024 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=6116 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=6420 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=6524 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=5172 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=6756 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=6664 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=5448 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=6952 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=7080 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=7328 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=7536 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=7768 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=7816 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7700 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=7640 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6928 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:908
- C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe
  "C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe" "C:\Users\Admin\Downloads\PyNoEscape2.pyw"
  2⤵
  - Executes dropped EXE
  PID:5188
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe "C:\Users\Admin\Downloads\PyNoEscape2.pyw"
    3⤵
    - Executes dropped EXE
    PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=7308 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=3308 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7608 --field-trial-handle=1900,i,10328615264468337354,7230575011733808860,131072 /prefetch:8
  2⤵
  PID:5760

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1528

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3120
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 138F6A1B4C690012833860204679E367
  2⤵
  - Loads dropped DLL
  PID:3528
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2968
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpfhwop5o_\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpfhwop5o_', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" .\flytest.py
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4912
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe
  "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install pypiwin32
  2⤵
  - Executes dropped EXE
  PID:4284
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\Scripts\pip.exe" install pypiwin32
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2272

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2092

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\flytest.py"
1⤵
- Executes dropped EXE
PID:4372
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\flytest.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1528

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1416
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\flytest.py
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2356

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x454 0x2f8
1⤵
PID:1708

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4312
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\PyNoEscape2.pyw
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\Admin\Downloads\PyNoEscape2.pyw"
  2⤵
  PID:5644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff88b8aab58,0x7ff88b8aab68,0x7ff88b8aab78
    3⤵
    PID:5636

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\PyNoEscape2.py"
1⤵
- Executes dropped EXE
PID:5236
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\PyNoEscape2.py"
  2⤵
  - Executes dropped EXE
  PID:3448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5184
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" .\PyNoEscape2.py
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" .\PyNoEscape2.py
  2⤵
  - Executes dropped EXE
  PID:6092
- C:\Windows\system32\net.exe
  "C:\Windows\system32\net.exe" localgroup administrators Admin /add
  2⤵
  PID:5408
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators Admin /add
    3⤵
    PID:5884
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" .\PyNoEscape2.py
  2⤵
  - Executes dropped EXE
  PID:6012

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\PyNoEscape2.py
1⤵
- Opens file in notepad (likely ransom note)
PID:5564

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\PyNoEscape2.py"
1⤵
- Executes dropped EXE
PID:5592
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\PyNoEscape2.py"
  2⤵
  - Executes dropped EXE
  PID:2716

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1180

C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
"C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
1⤵
- Executes dropped EXE
PID:3760
- C:\Windows\Temp\{B4BA4062-6F61-4CDC-B83F-69CCC460C5C0}\.cr\python-3.12.3-amd64.exe
  "C:\Windows\Temp\{B4BA4062-6F61-4CDC-B83F-69CCC460C5C0}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=528 -burn.filehandle.self=536
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  PID:4308

C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
"C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
1⤵
- Executes dropped EXE
PID:5552
- C:\Windows\Temp\{2E8BB1AB-96FF-4A2B-8984-29818B1340EB}\.cr\python-3.12.3-amd64.exe
  "C:\Windows\Temp\{2E8BB1AB-96FF-4A2B-8984-29818B1340EB}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=564
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  PID:5172

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 256219A7D77BEB5B46EF67F6132E7396
  2⤵
  PID:5376
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -B -m ensurepip._uninstall
    3⤵
    - Executes dropped EXE
    PID:5516
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = [] + sys.path sys.argv[1:] = ['uninstall', '-y', '--disable-pip-version-check', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      PID:5656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DCB149756BB4D8AA6B47F5717423D39D
  2⤵
  PID:4732
- - C:\Program Files\Python312\python.exe
    "C:\Program Files\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:5520
  - - C:\Program Files\Python312\python.exe
      "C:\Program Files\Python312\python.exe" -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpfd3xm2xq\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpfd3xm2xq', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:1440

C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
"C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
1⤵
- Executes dropped EXE
PID:2160
- C:\Windows\Temp\{881412DE-0EEE-42E8-A5E3-06396EB2BE1B}\.cr\python-3.12.3-amd64.exe
  "C:\Windows\Temp\{881412DE-0EEE-42E8-A5E3-06396EB2BE1B}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=528 -burn.filehandle.self=536
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  PID:232
- - C:\Windows\Temp\{67F2F863-168C-4757-96F6-557C9633B553}\.be\python-3.12.3-amd64.exe
    "C:\Windows\Temp\{67F2F863-168C-4757-96F6-557C9633B553}\.be\python-3.12.3-amd64.exe" -q -burn.elevated BurnPipe.{29672FFC-5004-46F8-9628-EB196F456214} {51B3694C-F440-4567-827B-3D5D119DB908} 232
    3⤵
    - Executes dropped EXE
    PID:3296
  - - C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe
      "C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
      4⤵
      Executes dropped EXE
      PID:5220
    - - C:\Program Files\Python312\python.exe
        
        "C:\Program Files\Python312\python.exe" -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5472
  - - C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe
      "C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -O -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
      4⤵
      Executes dropped EXE
      PID:5556
    - - C:\Program Files\Python312\python.exe
        
        "C:\Program Files\Python312\python.exe" -O -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:6000
  - - C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe
      "C:\ProgramData\Package Cache\EE7D6E4CB0818E2F1433C0FA7BA1682B6B7B0755\py.exe" -3.12 -OO -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
      4⤵
      Executes dropped EXE
      PID:2888
    - - C:\Program Files\Python312\python.exe
        
        "C:\Program Files\Python312\python.exe" -OO -E -s -Wi "C:\Program Files\Python312\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Program Files\Python312\Lib"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2004

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3304

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\PyNoEscape2.py"
1⤵
- Executes dropped EXE
PID:3576
- C:\Program Files\Python312\python.exe
  "C:\Program Files\Python312\python.exe" "C:\Users\Admin\Downloads\PyNoEscape2.py"
  2⤵
  - Executes dropped EXE
  PID:5236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:5696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
PID:3952

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\PyNoEscape2.py"
1⤵
- Executes dropped EXE
PID:4924
- C:\Program Files\Python312\python.exe
  "C:\Program Files\Python312\python.exe" "C:\Users\Admin\Downloads\PyNoEscape2.py"
  2⤵
  - Executes dropped EXE
  PID:6108

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\flytest.py"
1⤵
- Executes dropped EXE
PID:388
- C:\Program Files\Python312\python.exe
  "C:\Program Files\Python312\python.exe" "C:\Users\Admin\Downloads\flytest.py"
  2⤵
  - Executes dropped EXE
  PID:5884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery