4adfeb9a9f584c7039a6aa3b0121f7ed6c17b5ff85479b6a7246a28d619a669a

Analysis

max time kernel
1215s
max time network
1217s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/08/2024, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Natro Macro v1.0.0.2/nm_image_assets/Styles/Allure.dll
Size 1.2MB
Sample240804-mpawkstbnn
SHA256 39e78b8cf604c9c98c728f28e5cb20e497de710b5ca1202d150d7d5ebd8a79f3
MD5 95df1e2542700dc6c45d22ad4de28c02
SHA1 5255f77ce1439cb639e8b525df911100ae64b332
SHA512 362feb5b3fc6b0e87aafed2fe9f35025e31efae2452e4bda1589862c980ea77dcda475a4f729d49f5c7668ff13a13b1bd2af889b007b3b41b7931524f2c94f6b
SSDEEP 12288:ZpNrmiRwxONrTSBCKENr4qh7XxsOIwSU2myr3jSZ:mgOjg
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 45 IoCs

Web Service

T1102

flow	ioc
125	camo.githubusercontent.com
126	camo.githubusercontent.com
342	raw.githubusercontent.com
358	raw.githubusercontent.com
902	camo.githubusercontent.com
938	raw.githubusercontent.com
122	raw.githubusercontent.com
171	camo.githubusercontent.com
343	camo.githubusercontent.com
904	camo.githubusercontent.com
111	raw.githubusercontent.com
340	raw.githubusercontent.com
908	raw.githubusercontent.com
940	raw.githubusercontent.com
123	raw.githubusercontent.com
124	camo.githubusercontent.com
127	camo.githubusercontent.com
160	camo.githubusercontent.com
128	camo.githubusercontent.com
158	camo.githubusercontent.com
164	raw.githubusercontent.com
344	camo.githubusercontent.com
345	camo.githubusercontent.com
347	camo.githubusercontent.com
379	camo.githubusercontent.com
900	camo.githubusercontent.com
901	raw.githubusercontent.com
909	camo.githubusercontent.com
161	camo.githubusercontent.com
346	camo.githubusercontent.com
360	camo.githubusercontent.com
364	camo.githubusercontent.com
903	camo.githubusercontent.com
129	camo.githubusercontent.com
167	camo.githubusercontent.com
169	camo.githubusercontent.com
115	camo.githubusercontent.com
341	camo.githubusercontent.com
357	camo.githubusercontent.com
359	camo.githubusercontent.com
361	camo.githubusercontent.com
899	raw.githubusercontent.com
905	camo.githubusercontent.com
906	camo.githubusercontent.com
941	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	3868	WerFault.exe	70

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoHotkey32.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428929930"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0BDDD1E1-524E-11EF-B4D0-D238DC34531D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b066a2e25ae6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000031af1483a5441bf1901bc40f5388c9e9bb443e74a669a666bff5def9dd7b21d6000000000e8000000002000020000000bc406e173e18ec153be9a1716bd6c9dfe8fab64f9357c7da4857a38a5b4cdd4d20000000208ccb5765af4080c29dec4b22f0bee1cadcf8b2c48d41b8692fa65681345f0640000000ed553079762139925d0673043f601a9c4472a380dd66ae8a5dc5278a96dafdd9ec0edf791bd3379d96796872e9146a8a52cc09405973afc4bdd11b240cb7abf9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000f8aa531af2558a2633ed29a61fb655141540c421ced59272ea1807db69ebc226000000000e800000000200002000000026c6e02afb6a3818ee2d69af0e2d070b29d7dba13a13dc8765f9c2f651b4665e900000006fc56e14d0ade05b6d91f709c854c439d436685994f7ca2e3882ce0bf29121b7270e7275c01be9ddde7ede56e0869d0c15a1d71f5a641c9b53c5f6a5bb95ef287ce5904804be2614fd61ca8e6299368b4509c898ced87115a5c77f86e9ead3d4cf75c6f5a03382f0c027724cbc1136a175259b7694a2d015828ce9f9b237ad06e6b9cc2bb0bfb397a8d00af2afb5a3c7400000004e1e75faadb3d2b36a696a5f2957a9f96c813e474c9c227dce50c0919f4129d9d3818b01d23a636d904f802cadd43c26443baaf9040191428e9e751b9a34e90e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2.zip:Zone.Identifier	firefox.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3868	AutoHotkey32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2820	chrome.exe
2820	chrome.exe
3868	AutoHotkey32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3868	AutoHotkey32.exe
3872	AutoHotkey32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
3004	iexplore.exe
1528	firefox.exe
1528	firefox.exe
1528	firefox.exe
1528	firefox.exe
3868	AutoHotkey32.exe
3868	AutoHotkey32.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
1528	firefox.exe
1528	firefox.exe
1528	firefox.exe
3868	AutoHotkey32.exe
3868	AutoHotkey32.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
3004	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
1528	firefox.exe
1528	firefox.exe
1528	firefox.exe
3868	AutoHotkey32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1524	2820	chrome.exe	34
PID 2820 wrote to memory of 1524	2820	chrome.exe	34
PID 2820 wrote to memory of 1524	2820	chrome.exe	34
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2112	2820	chrome.exe	36
PID 2820 wrote to memory of 2328	2820	chrome.exe	37
PID 2820 wrote to memory of 2328	2820	chrome.exe	37
PID 2820 wrote to memory of 2328	2820	chrome.exe	37
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38
PID 2820 wrote to memory of 1104	2820	chrome.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Natro Macro v1.0.0.2\nm_image_assets\Styles\Allure.dll",#1
1⤵
PID:2116

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5f99758,0x7fef5f99768,0x7fef5f99778
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1284,i,5340828850020839492,8680013397893829302,131072 /prefetch:2
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1284,i,5340828850020839492,8680013397893829302,131072 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1284,i,5340828850020839492,8680013397893829302,131072 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2268 --field-trial-handle=1284,i,5340828850020839492,8680013397893829302,131072 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2276 --field-trial-handle=1284,i,5340828850020839492,8680013397893829302,131072 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2828 --field-trial-handle=1284,i,5340828850020839492,8680013397893829302,131072 /prefetch:2
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1416 --field-trial-handle=1284,i,5340828850020839492,8680013397893829302,131072 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 --field-trial-handle=1284,i,5340828850020839492,8680013397893829302,131072 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3852 --field-trial-handle=1284,i,5340828850020839492,8680013397893829302,131072 /prefetch:1
  2⤵
  PID:472

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2980

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:340994 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2456
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.0.290809896\1475746653" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a5e69f3-a8d7-48e9-884b-d9aedec41619} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 1308 114d4b58 gpu
    3⤵
    PID:988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.1.12883884\260599942" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0ac0e25-4548-4ae5-91ef-c0dc6d8fc710} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 1512 e72858 socket
    3⤵
    - Checks processor information in registry
    PID:2052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.2.1235321135\1381514449" -childID 1 -isForBrowser -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {23d5e0a1-ba1e-4a3f-92e6-661635c8a3ab} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 2164 11463d58 tab
    3⤵
    PID:2468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.3.1409872639\1556232420" -childID 2 -isForBrowser -prefsHandle 572 -prefMapHandle 564 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d838d241-68f6-4d49-8a3f-31088bc7daa8} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 2060 e71958 tab
    3⤵
    PID:2600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.4.1833350455\36339190" -childID 3 -isForBrowser -prefsHandle 2960 -prefMapHandle 2956 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6293e171-8713-49ae-9306-546d15ccf4a1} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 2972 1c62ae58 tab
    3⤵
    PID:2508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.5.1030096185\1110649455" -childID 4 -isForBrowser -prefsHandle 3816 -prefMapHandle 3820 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3481cd1b-8123-4901-99cf-099a18264cfe} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 3836 e69658 tab
    3⤵
    PID:1392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.6.1050721370\862421455" -childID 5 -isForBrowser -prefsHandle 3944 -prefMapHandle 3948 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f9540ff-e620-4401-adaa-b59bbf8046dc} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 3932 1e6d4858 tab
    3⤵
    PID:836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.7.1737270031\149517680" -childID 6 -isForBrowser -prefsHandle 4124 -prefMapHandle 4128 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {660cd827-77d2-4dad-8b10-7df29319ba18} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 4112 1e6d4e58 tab
    3⤵
    PID:2020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.8.904599724\76026050" -childID 7 -isForBrowser -prefsHandle 4488 -prefMapHandle 4480 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24dd856f-5558-4dd0-b884-4da08f7b7656} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 4496 224bce58 tab
    3⤵
    PID:3164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1528.9.926331634\1059824821" -childID 8 -isForBrowser -prefsHandle 3868 -prefMapHandle 3888 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a28b18e6-3e35-472a-abea-14c2d9a0414b} 1528 "\\.\pipe\gecko-crash-server-pipe.1528" 3904 1f604758 tab
    3⤵
    PID:1068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x480
1⤵
PID:3572

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2220

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\START.bat" "
1⤵
PID:3832
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3856
- C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey32.exe
  "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey32.exe" "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\natro_macro.ahk"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3868
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey32.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey32.exe" /script "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\Heartbeat.ahk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3872
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:3880
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:3900
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:3908
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:3928
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:3956
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:2756
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:3984
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:3968
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:3976
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:3996
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:4004
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script /Validate /ErrorStdOut *
    3⤵
    PID:4016
- - C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe
    "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\AutoHotkey64.exe" /script "C:\Users\Admin\Downloads\Natro_Macro_v1.0.0.2\Natro Macro v1.0.0.2\submacros\Status.ahk" "0" "0" "" "" "1" "" "1" "" "0" "0" "0" "1" "1" "1" "1" "1" "1" "1" "0" "0" "" "1" "1" "1" "1" "0" "0" "?" "0" "" "" "" "" "1" "0"
    3⤵
    PID:4044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1632
    3⤵
    - Program crash
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6B2043001D270792DFFD725518EAFE2C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C
Size 579B
SHA256 31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0
MD5 f55da450a5fb287e1e0f0dcc965756ca
SHA1 7e04de896a3e666d00e687d33ffad93be83d349e
SHA512 19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630
MD5 SHA1 SHA512

Submit Download

A66A8DB907BADC9D16AD67B2FBFFDD5C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C
Size 281B
SHA256 165a9f3c3e0d665141953f05ec60ff6959e6b15cc50d9cb2746a26937181543b
MD5 4ec59ac8f3b2ae95168c9cabd3147151
SHA1 de7d5e63c988b9c27f17a6dd8b3e2d6a1208fe2d
SHA512 832e5712fa43c890d03ca4c437b11b23bd74d7c383ee095e2bc9380845f592a468fb5cd1eef7d637ae7d34a0b9bc3c11bef84e78d5c42e7ac78ca05aec026599
MD5 SHA1 SHA512

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Size 1KB
SHA256 cd67b64ae69f04d81477ae47f5fa7156d56a698721cd4d3e5e0ade91734084e5
MD5 b5ab17d4f916b16f107429fbd0724c93
SHA1 39b2c6bd172c89440129f35b481538eb6e7dd54f
SHA512 788dd105a5bb65532e3dd64f8091481dd7e9e6d37ff897fc1ececfd23e41cbd1065b79d583713cd035fef81ee677f22cef7aa969641826b1c222ea983481f9aa
MD5 SHA1 SHA512

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Size 978B
SHA256 116d2c6230b40ac3a295209a862f90abb051b458d16f0a5cbab293935c6e2585
MD5 fcd451d100451b87ac42092de358782e
SHA1 f701b9bc3fff61891b31ff0c826f33c874831384
SHA512 1fd1ea3cd1d740d1ac9a25cd48dedb6bea007c89702de2799357a784680f60f649114367d9cbbb1f001e8a9edfa5c9301b00b30be5c63202fd330839be600062
MD5 SHA1 SHA512

Submit Download

6B2043001D270792DFFD725518EAFE2C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C
Size 252B
SHA256 3e176be1898cd10629c5cd6c37a7f00c295c412041600502a7031e79f9297072
MD5 1ef152546017d90f77b834f2bee797b3
SHA1 cc1d908bd23a722d4dcaf6046dcb1108ec98deb6
SHA512 39aaf32f48e4d29cadebdcf21e54f6b544961ce271584980ea7d2be6b0be8772954e86b0112eb0a18ef8be156a28bd26537bfcb3be2831100413baebf3ba990c
MD5 SHA1 SHA512

Submit Download