a7720638aee803b36ede0135b593d476a86706174e2b2657975cc631e4368ff2

Virtualization/Sandbox Evasion

Processes:

Plasmafree.exePlasmafree.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	Plasmafree.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	Plasmafree.exe

Downloads MZ/PE file

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

Plasmafree.exePlasmafree.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	Plasmafree.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	Plasmafree.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

runtimedotnet.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ivFcrnUCgJKnCN\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\ivFcrnUCgJKnCN"	runtimedotnet.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Plasmafree.exePlasmafree.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Plasmafree.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Plasmafree.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Plasmafree.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Plasmafree.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Plasmafree.exePlasmafree.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	Plasmafree.exe
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	Plasmafree.exe

Executes dropped EXE 6 IoCs

Processes:

7z2301-x64.exe7z2301-x64.exe7zG.exePlasmafree.exePlasmafree.exeruntimedotnet.exe

pid process

4676 7z2301-x64.exe
4716 7z2301-x64.exe
2104 7zG.exe
228 Plasmafree.exe
4880 Plasmafree.exe
2484 runtimedotnet.exe
Loads dropped DLL 6 IoCs

Processes:

7zG.exeruntimedotnet.exe

pid process

2104 7zG.exe
2484 runtimedotnet.exe
2484 runtimedotnet.exe
2484 runtimedotnet.exe
2484 runtimedotnet.exe
2484 runtimedotnet.exe

pid	process
4676	7z2301-x64.exe
4716	7z2301-x64.exe
2104	7zG.exe
228	Plasmafree.exe
4880	Plasmafree.exe
2484	runtimedotnet.exe

pid	process
2104	7zG.exe
2484	runtimedotnet.exe
2484	runtimedotnet.exe
2484	runtimedotnet.exe
2484	runtimedotnet.exe
2484	runtimedotnet.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

7z2301-x64.exe7z2301-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Plasmafree.exePlasmafree.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Plasmafree.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Plasmafree.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Plasmafree.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Plasmafree.exe

Drops file in System32 directory 14 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe

Drops file in Program Files directory 64 IoCs

Processes:

7z2301-x64.exe7z2301-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2301-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2301-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2301-x64.exe

Drops file in Windows directory 3 IoCs

Processes:

Plasmafree.exe

description	ioc	process
File created	C:\Windows\VOLUMEID.exe	Plasmafree.exe
File created	C:\Windows\GameBarPresenceWriter\drive.sys	Plasmafree.exe
File created	C:\Windows\GameBarPresenceWriter\runtimedotnet.exe	Plasmafree.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

1700 sc.exe
5024 sc.exe
368 sc.exe
3404 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3632 228 WerFault.exe Plasmafree.exe
3008 4880 WerFault.exe Plasmafree.exe

pid	process
1700	sc.exe
5024	sc.exe
368	sc.exe
3404	sc.exe

pid	pid_target	process	target process
3632	228	WerFault.exe	Plasmafree.exe
3008	4880	WerFault.exe	Plasmafree.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

3324 ipconfig.exe
3204 ipconfig.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2068 taskkill.exe

pid	process
3324	ipconfig.exe
3204	ipconfig.exe

pid	process
2068	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585162163886229"	chrome.exe

Modifies registry class 44 IoCs

Processes:

7z2301-x64.exe7z2301-x64.exeOpenWith.exeOpenWith.execmd.exechrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exePlasmafree.exe

pid	process
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
1724	chrome.exe
1724	chrome.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe
228	Plasmafree.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

3184 OpenWith.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

runtimedotnet.exe

pid process

2484 runtimedotnet.exe

pid	process
2484	runtimedotnet.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

chrome.exe

pid	process
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

Processes:

chrome.exe7zG.exe

pid	process
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
2104	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe

Suspicious use of SetWindowsHookEx 34 IoCs

Processes:

OpenWith.exeOpenWith.exe7z2301-x64.exeruntimedotnet.exe

pid	process
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
3184	OpenWith.exe
4456	OpenWith.exe
4456	OpenWith.exe
4456	OpenWith.exe
4716	7z2301-x64.exe
2484	runtimedotnet.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3320 wrote to memory of 2084	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 2084	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4400	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 3724	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 3724	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe
PID 3320 wrote to memory of 4236	3320	chrome.exe	chrome.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Secured.rar
1⤵
- Modifies registry class
PID:4512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa9055ab58,0x7ffa9055ab68,0x7ffa9055ab78
2⤵
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:2
2⤵
PID:4400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:3724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1988 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:4236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:1852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:5096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4336 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:1220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4524 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:4544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4660 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:1136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:4480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:3884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4996 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:2636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:2648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:4916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:3716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5108 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:4012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4068 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:3880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4988 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:1724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5044 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:4000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4584 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:1000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5032 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3520 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:3748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3444 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:1568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:4364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5284 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5504 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5652 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:5008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=3468 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:1640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=2052 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:1
2⤵
PID:3524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5624 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:4888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5668 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:1016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:2712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:4596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5580 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:1132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5804 --field-trial-handle=2400,i,2925731637886552434,18304594218734779421,131072 /prefetch:8
2⤵
PID:3252

C:\Users\Admin\Downloads\7z2301-x64.exe
"C:\Users\Admin\Downloads\7z2301-x64.exe"
2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:4676

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4456

C:\Users\Admin\Downloads\7z2301-x64.exe
"C:\Users\Admin\Downloads\7z2301-x64.exe"
1⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4716

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Secured\" -spe -an -ai#7zMap26838:76:7zEvent18513
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2104

C:\Users\Admin\Downloads\Secured\Plasmafree.exe
"C:\Users\Admin\Downloads\Secured\Plasmafree.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:228

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\serialchecker.bat" "
2⤵
PID:1908

C:\Windows\SysWOW64\mode.com
mode con: cols=90 lines=48
3⤵
PID:3484

C:\Windows\SysWOW64\net.exe
net stop winmgmt /y
3⤵
PID:2088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop winmgmt /y
4⤵
PID:2516

C:\Windows\SysWOW64\net.exe
net start winmgmt /y
3⤵
PID:2964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start winmgmt /y
4⤵
PID:3428

C:\Windows\SysWOW64\sc.exe
sc stop winmgmt
3⤵
- Launches sc.exe
PID:1700

C:\Windows\SysWOW64\sc.exe
sc start winmgmt
3⤵
- Launches sc.exe
PID:5024

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:3324

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic bios get serialnumber
3⤵
PID:1072

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic csproduct get uuid
3⤵
PID:3352

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get serialnumber
3⤵
PID:3316

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get processorid
3⤵
PID:3128

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic diskdrive get serialnumber
3⤵
PID:3660

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic baseboard get serialnumber
3⤵
PID:2892

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic memorychip get serialnumber
3⤵
PID:404

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
3⤵
PID:1396

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Description,PNPDeviceID
3⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 2308
2⤵
- Program crash
PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:4468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 228 -ip 228
1⤵
PID:3544

C:\Users\Admin\Downloads\Secured\Plasmafree.exe
"C:\Users\Admin\Downloads\Secured\Plasmafree.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in Windows directory
PID:4880

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic.exe" diskdrive get serialnumber
2⤵
PID:1644

C:\Windows\GameBarPresenceWriter\runtimedotnet.exe
"C:\Windows\GameBarPresenceWriter\runtimedotnet.exe" C:\Windows\GameBarPresenceWriter\drive.sys
2⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
PID:2484

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Windows\VOLUMEID.exe
2⤵
PID:5088

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /f /im WmiPrvSE.exe
2⤵
PID:5048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im WmiPrvSE.exe
3⤵
- Kills process with taskkill
PID:2068

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic.exe" diskdrive get serialnumber
2⤵
PID:2892

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\serialchecker.bat" "
2⤵
PID:1400

C:\Windows\SysWOW64\mode.com
mode con: cols=90 lines=48
3⤵
PID:2080

C:\Windows\SysWOW64\net.exe
net stop winmgmt /y
3⤵
PID:880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop winmgmt /y
4⤵
PID:228

C:\Windows\SysWOW64\net.exe
net start winmgmt /y
3⤵
PID:3492

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start winmgmt /y
4⤵
PID:2860

C:\Windows\SysWOW64\sc.exe
sc stop winmgmt
3⤵
- Launches sc.exe
PID:368

C:\Windows\SysWOW64\sc.exe
sc start winmgmt
3⤵
- Launches sc.exe
PID:3404

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:3204

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic bios get serialnumber
3⤵
PID:1160

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic csproduct get uuid
3⤵
PID:4068

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get serialnumber
3⤵
PID:1144

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get processorid
3⤵
PID:4648

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic diskdrive get serialnumber
3⤵
PID:556

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic baseboard get serialnumber
3⤵
PID:4352

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic memorychip get serialnumber
3⤵
PID:2068

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
3⤵
PID:756

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Description,PNPDeviceID
3⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 2504
2⤵
- Program crash
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4880 -ip 4880
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:4716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:4416

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Virtualization/Sandbox Evasion

Modify Registry

T1112

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery