fabookie | 13bb0e481be407e8244a6c1f5b0be8a436d433040e2be69f5d27f5922aa2882c

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	62616376636b2_Thu14254a34538.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
139	3328	rundll32.exe
147	3328	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2972	powershell.exe
3172	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	62616376636b2_Thu14254a34538.exe

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000023c8f-61.dat	aspack_v212_v242
behavioral2/files/0x0007000000023c92-67.dat	aspack_v212_v242
behavioral2/files/0x000d000000023b48-86.dat	aspack_v212_v242
behavioral2/files/0x0007000000023c90-62.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	62616376636b2_Thu14254a34538.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	62616376636b2_Thu14254a34538.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	6f36bb5a55e529c45eaff76ec91f1949.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	62616365ede4e_Thu1434cdb52.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	6261636804fe8_Thu147d5377a.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	6261636af257b_Thu144d45764b03.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	626163713dc7a_Thu1481e15b0.exe

Executes dropped EXE 24 IoCs

pid	Process
532	setup_installer.exe
1168	setup_install.exe
5100	626163638f111_Thu147fb285819e.exe
4492	62616364495a4_Thu14652e42c0a.exe
2584	62616365ede4e_Thu1434cdb52.exe
4180	6261636285d1b_Thu14bfc43d37b.exe
2196	6261636964cb0_Thu1476d1f4ee.exe
4488	6261636804fe8_Thu147d5377a.exe
4576	6261636af257b_Thu144d45764b03.exe
2304	62616376636b2_Thu14254a34538.exe
4380	6261636804fe8_Thu147d5377a.tmp
2120	626163713dc7a_Thu1481e15b0.exe
3720	6261636bd5887_Thu140cd692e88.exe
1888	6261636dc936c_Thu144f505bc8c.exe
1944	626163725d1ab_Thu142a4ef3e1a.exe
4432	626163705fdd8_Thu1454a3a2ecd.exe
452	62616365ede4e_Thu1434cdb52.exe
3532	62616375354c4_Thu1489cd3f.exe
3184	626163725d1ab_Thu142a4ef3e1a.tmp
4720	6261636804fe8_Thu147d5377a.exe
3376	62616364495a4_Thu14652e42c0a.exe
1308	6261636804fe8_Thu147d5377a.tmp
3928	62616376636b2_Thu14254a34538.exe
4892	626163705fdd8_Thu1454a3a2ecd.exe

Loads dropped DLL 17 IoCs

pid	Process
1168	setup_install.exe
1168	setup_install.exe
1168	setup_install.exe
1168	setup_install.exe
1168	setup_install.exe
1168	setup_install.exe
1168	setup_install.exe
4180	6261636285d1b_Thu14bfc43d37b.exe
4180	6261636285d1b_Thu14bfc43d37b.exe
4180	6261636285d1b_Thu14bfc43d37b.exe
4380	6261636804fe8_Thu147d5377a.tmp
3184	626163725d1ab_Thu142a4ef3e1a.tmp
1308	6261636804fe8_Thu147d5377a.tmp
2792	rundll32.exe
2792	rundll32.exe
3328	rundll32.exe
3328	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0007000000023c89-111.dat	vmprotect
behavioral2/memory/1888-185-0x0000000140000000-0x00000001406E2000-memory.dmp	vmprotect

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aieoplapobidheellikiicjfpamacpfd\11.23.45_0\manifest.json	62616375354c4_Thu1489cd3f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
42	iplogger.org
43	iplogger.org
57	iplogger.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	62616376636b2_Thu14254a34538.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	62616376636b2_Thu14254a34538.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4492 set thread context of 3376	4492	62616364495a4_Thu14652e42c0a.exe	115
PID 2304 set thread context of 3928	2304	62616376636b2_Thu14254a34538.exe	136
PID 4432 set thread context of 4892	4432	626163705fdd8_Thu1454a3a2ecd.exe	140

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
2440	2120	WerFault.exe	118
1728	2196	WerFault.exe	106
2688	3720	WerFault.exe	117
3576	3720	WerFault.exe	117
2144	3720	WerFault.exe	117
4380	3720	WerFault.exe	117
4376	3720	WerFault.exe	117
4444	3720	WerFault.exe	117
2392	3720	WerFault.exe	117
6460	3720	WerFault.exe	117

System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	626163713dc7a_Thu1481e15b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62616365ede4e_Thu1434cdb52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f36bb5a55e529c45eaff76ec91f1949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6261636804fe8_Thu147d5377a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6261636964cb0_Thu1476d1f4ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6261636804fe8_Thu147d5377a.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62616365ede4e_Thu1434cdb52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	626163725d1ab_Thu142a4ef3e1a.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6261636804fe8_Thu147d5377a.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6261636af257b_Thu144d45764b03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	626163705fdd8_Thu1454a3a2ecd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62616364495a4_Thu14652e42c0a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62616376636b2_Thu14254a34538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6261636285d1b_Thu14bfc43d37b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62616375354c4_Thu1489cd3f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	626163705fdd8_Thu1454a3a2ecd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62616364495a4_Thu14652e42c0a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6261636bd5887_Thu140cd692e88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	626163725d1ab_Thu142a4ef3e1a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6261636804fe8_Thu147d5377a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62616376636b2_Thu14254a34538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6261636964cb0_Thu1476d1f4ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6261636964cb0_Thu1476d1f4ee.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6261636964cb0_Thu1476d1f4ee.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	626163638f111_Thu147fb285819e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	626163638f111_Thu147fb285819e.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1416	taskkill.exe
2804	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133754545377535779"	chrome.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2972	powershell.exe
2972	powershell.exe
2972	powershell.exe
2304	62616376636b2_Thu14254a34538.exe
2304	62616376636b2_Thu14254a34538.exe
2304	62616376636b2_Thu14254a34538.exe
2304	62616376636b2_Thu14254a34538.exe
3172	powershell.exe
3172	powershell.exe
2304	62616376636b2_Thu14254a34538.exe
2304	62616376636b2_Thu14254a34538.exe
2304	62616376636b2_Thu14254a34538.exe
2304	62616376636b2_Thu14254a34538.exe
3172	powershell.exe
5100	626163638f111_Thu147fb285819e.exe
5100	626163638f111_Thu147fb285819e.exe
2304	62616376636b2_Thu14254a34538.exe
2304	62616376636b2_Thu14254a34538.exe
4708	chrome.exe
4708	chrome.exe
5232	chrome.exe
5232	chrome.exe
5232	chrome.exe
5232	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3720	6261636bd5887_Thu140cd692e88.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	2304	62616376636b2_Thu14254a34538.exe
Token: SeCreateTokenPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeAssignPrimaryTokenPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeLockMemoryPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeIncreaseQuotaPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeMachineAccountPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeTcbPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeSecurityPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeTakeOwnershipPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeLoadDriverPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeSystemProfilePrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeSystemtimePrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeProfSingleProcessPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeIncBasePriorityPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeCreatePagefilePrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeCreatePermanentPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeBackupPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeRestorePrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeShutdownPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeDebugPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeAuditPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeSystemEnvironmentPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeChangeNotifyPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeRemoteShutdownPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeUndockPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeSyncAgentPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeEnableDelegationPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeManageVolumePrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeImpersonatePrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: SeCreateGlobalPrivilege	3532	62616375354c4_Thu1489cd3f.exe
Token: 31	3532	62616375354c4_Thu1489cd3f.exe
Token: 32	3532	62616375354c4_Thu1489cd3f.exe
Token: 33	3532	62616375354c4_Thu1489cd3f.exe
Token: 34	3532	62616375354c4_Thu1489cd3f.exe
Token: 35	3532	62616375354c4_Thu1489cd3f.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	1416	taskkill.exe
Token: SeDebugPrivilege	5100	626163638f111_Thu147fb285819e.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2584	62616365ede4e_Thu1434cdb52.exe
2584	62616365ede4e_Thu1434cdb52.exe
452	62616365ede4e_Thu1434cdb52.exe
452	62616365ede4e_Thu1434cdb52.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 532	1312	6f36bb5a55e529c45eaff76ec91f1949.exe	86
PID 1312 wrote to memory of 532	1312	6f36bb5a55e529c45eaff76ec91f1949.exe	86
PID 1312 wrote to memory of 532	1312	6f36bb5a55e529c45eaff76ec91f1949.exe	86
PID 532 wrote to memory of 1168	532	setup_installer.exe	87
PID 532 wrote to memory of 1168	532	setup_installer.exe	87
PID 532 wrote to memory of 1168	532	setup_installer.exe	87
PID 1168 wrote to memory of 4752	1168	setup_install.exe	90
PID 1168 wrote to memory of 4752	1168	setup_install.exe	90
PID 1168 wrote to memory of 4752	1168	setup_install.exe	90
PID 1168 wrote to memory of 3436	1168	setup_install.exe	91
PID 1168 wrote to memory of 3436	1168	setup_install.exe	91
PID 1168 wrote to memory of 3436	1168	setup_install.exe	91
PID 1168 wrote to memory of 1884	1168	setup_install.exe	92
PID 1168 wrote to memory of 1884	1168	setup_install.exe	92
PID 1168 wrote to memory of 1884	1168	setup_install.exe	92
PID 1168 wrote to memory of 3464	1168	setup_install.exe	93
PID 1168 wrote to memory of 3464	1168	setup_install.exe	93
PID 1168 wrote to memory of 3464	1168	setup_install.exe	93
PID 1168 wrote to memory of 4264	1168	setup_install.exe	94
PID 1168 wrote to memory of 4264	1168	setup_install.exe	94
PID 1168 wrote to memory of 4264	1168	setup_install.exe	94
PID 1168 wrote to memory of 1596	1168	setup_install.exe	95
PID 1168 wrote to memory of 1596	1168	setup_install.exe	95
PID 1168 wrote to memory of 1596	1168	setup_install.exe	95
PID 1168 wrote to memory of 1764	1168	setup_install.exe	96
PID 1168 wrote to memory of 1764	1168	setup_install.exe	96
PID 1168 wrote to memory of 1764	1168	setup_install.exe	96
PID 1168 wrote to memory of 2936	1168	setup_install.exe	97
PID 1168 wrote to memory of 2936	1168	setup_install.exe	97
PID 1168 wrote to memory of 2936	1168	setup_install.exe	97
PID 4752 wrote to memory of 2972	4752	cmd.exe	101
PID 4752 wrote to memory of 2972	4752	cmd.exe	101
PID 4752 wrote to memory of 2972	4752	cmd.exe	101
PID 1168 wrote to memory of 4076	1168	setup_install.exe	98
PID 1168 wrote to memory of 4076	1168	setup_install.exe	98
PID 1168 wrote to memory of 4076	1168	setup_install.exe	98
PID 3436 wrote to memory of 4180	3436	cmd.exe	99
PID 3436 wrote to memory of 4180	3436	cmd.exe	99
PID 3436 wrote to memory of 4180	3436	cmd.exe	99
PID 1168 wrote to memory of 2564	1168	setup_install.exe	107
PID 1168 wrote to memory of 2564	1168	setup_install.exe	107
PID 1168 wrote to memory of 2564	1168	setup_install.exe	107
PID 1884 wrote to memory of 5100	1884	cmd.exe	100
PID 1884 wrote to memory of 5100	1884	cmd.exe	100
PID 1168 wrote to memory of 4904	1168	setup_install.exe	108
PID 1168 wrote to memory of 4904	1168	setup_install.exe	108
PID 1168 wrote to memory of 4904	1168	setup_install.exe	108
PID 1168 wrote to memory of 1272	1168	setup_install.exe	109
PID 1168 wrote to memory of 1272	1168	setup_install.exe	109
PID 1168 wrote to memory of 1272	1168	setup_install.exe	109
PID 1168 wrote to memory of 1688	1168	setup_install.exe	110
PID 1168 wrote to memory of 1688	1168	setup_install.exe	110
PID 1168 wrote to memory of 1688	1168	setup_install.exe	110
PID 1168 wrote to memory of 1448	1168	setup_install.exe	111
PID 1168 wrote to memory of 1448	1168	setup_install.exe	111
PID 1168 wrote to memory of 1448	1168	setup_install.exe	111
PID 1168 wrote to memory of 2620	1168	setup_install.exe	112
PID 1168 wrote to memory of 2620	1168	setup_install.exe	112
PID 1168 wrote to memory of 2620	1168	setup_install.exe	112
PID 3464 wrote to memory of 4492	3464	cmd.exe	102
PID 3464 wrote to memory of 4492	3464	cmd.exe	102
PID 3464 wrote to memory of 4492	3464	cmd.exe	102
PID 1764 wrote to memory of 2196	1764	cmd.exe	106
PID 1764 wrote to memory of 2196	1764	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\6f36bb5a55e529c45eaff76ec91f1949.exe
"C:\Users\Admin\AppData\Local\Temp\6f36bb5a55e529c45eaff76ec91f1949.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS412208B7\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4752
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 6261636285d1b_Thu14bfc43d37b.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\6261636285d1b_Thu14bfc43d37b.exe
        
        6261636285d1b_Thu14bfc43d37b.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4180
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 626163638f111_Thu147fb285819e.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\626163638f111_Thu147fb285819e.exe
        
        626163638f111_Thu147fb285819e.exe
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 62616364495a4_Thu14652e42c0a.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\62616364495a4_Thu14652e42c0a.exe
        
        62616364495a4_Thu14652e42c0a.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\62616364495a4_Thu14652e42c0a.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS412208B7\62616364495a4_Thu14652e42c0a.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 62616365ede4e_Thu1434cdb52.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\62616365ede4e_Thu1434cdb52.exe
        
        62616365ede4e_Thu1434cdb52.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\62616365ede4e_Thu1434cdb52.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS412208B7\62616365ede4e_Thu1434cdb52.exe" -h
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 6261636804fe8_Thu147d5377a.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\6261636804fe8_Thu147d5377a.exe
        
        6261636804fe8_Thu147d5377a.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\is-A0442.tmp\6261636804fe8_Thu147d5377a.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-A0442.tmp\6261636804fe8_Thu147d5377a.tmp" /SL5="$70298,921146,831488,C:\Users\Admin\AppData\Local\Temp\7zS412208B7\6261636804fe8_Thu147d5377a.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\7zS412208B7\6261636804fe8_Thu147d5377a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS412208B7\6261636804fe8_Thu147d5377a.exe" /SILENT
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\is-873PC.tmp\6261636804fe8_Thu147d5377a.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-873PC.tmp\6261636804fe8_Thu147d5377a.tmp" /SL5="$20266,921146,831488,C:\Users\Admin\AppData\Local\Temp\7zS412208B7\6261636804fe8_Thu147d5377a.exe" /SILENT
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 6261636964cb0_Thu1476d1f4ee.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\6261636964cb0_Thu1476d1f4ee.exe
        
        6261636964cb0_Thu1476d1f4ee.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        
        PID:2196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 356
        6⤵
        Program crash
        
        PID:1728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 6261636af257b_Thu144d45764b03.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\6261636af257b_Thu144d45764b03.exe
        
        6261636af257b_Thu144d45764b03.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4576
      - C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" .\VQY~ZP~Y.g
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\VQY~ZP~Y.g
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\VQY~ZP~Y.g
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\VQY~ZP~Y.g
        9⤵
        Blocklisted process makes network request
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 6261636bd5887_Thu140cd692e88.exe /mixtwo
      4⤵
      System Location Discovery: System Language Discovery
      PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\6261636bd5887_Thu140cd692e88.exe
        
        6261636bd5887_Thu140cd692e88.exe /mixtwo
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:3720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 268
        6⤵
        Program crash
        
        PID:2688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 772
        6⤵
        Program crash
        
        PID:3576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 780
        6⤵
        Program crash
        
        PID:2144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 780
        6⤵
        Program crash
        
        PID:4380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 816
        6⤵
        Program crash
        
        PID:4376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 804
        6⤵
        Program crash
        
        PID:4444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1012
        6⤵
        Program crash
        
        PID:2392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 796
        6⤵
        Program crash
        
        PID:6460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 6261636dc936c_Thu144f505bc8c.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\6261636dc936c_Thu144f505bc8c.exe
        
        6261636dc936c_Thu144f505bc8c.exe
        5⤵
        Executes dropped EXE
        
        PID:1888
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 626163705fdd8_Thu1454a3a2ecd.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\626163705fdd8_Thu1454a3a2ecd.exe
        
        626163705fdd8_Thu1454a3a2ecd.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\626163705fdd8_Thu1454a3a2ecd.exe
        
        626163705fdd8_Thu1454a3a2ecd.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 626163713dc7a_Thu1481e15b0.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\626163713dc7a_Thu1481e15b0.exe
        
        626163713dc7a_Thu1481e15b0.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2120
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "626163713dc7a_Thu1481e15b0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS412208B7\626163713dc7a_Thu1481e15b0.exe" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "626163713dc7a_Thu1481e15b0.exe" /f
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1416
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 1420
        6⤵
        Program crash
        
        PID:2440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 626163725d1ab_Thu142a4ef3e1a.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\626163725d1ab_Thu142a4ef3e1a.exe
        
        626163725d1ab_Thu142a4ef3e1a.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\is-2RI7F.tmp\626163725d1ab_Thu142a4ef3e1a.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-2RI7F.tmp\626163725d1ab_Thu142a4ef3e1a.tmp" /SL5="$A004A,506127,422400,C:\Users\Admin\AppData\Local\Temp\7zS412208B7\626163725d1ab_Thu142a4ef3e1a.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 62616375354c4_Thu1489cd3f.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\62616375354c4_Thu1489cd3f.exe
        
        62616375354c4_Thu1489cd3f.exe
        5⤵
        Executes dropped EXE
        Drops Chrome extension
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4708
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8e050cc40,0x7ff8e050cc4c,0x7ff8e050cc58
        7⤵
        
        PID:4916
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1844,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1768 /prefetch:2
        7⤵
        
        PID:2012
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2004,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2212 /prefetch:3
        7⤵
        
        PID:4836
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2248 /prefetch:8
        7⤵
        
        PID:3436
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3132 /prefetch:1
        7⤵
        
        PID:4664
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3264,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3284 /prefetch:1
        7⤵
        
        PID:2252
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4544,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4552 /prefetch:1
        7⤵
        
        PID:3476
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4412,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3756 /prefetch:8
        7⤵
        
        PID:1544
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3680 /prefetch:8
        7⤵
        
        PID:1736
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4944,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5016 /prefetch:8
        7⤵
        
        PID:2300
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5300,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5312 /prefetch:8
        7⤵
        
        PID:2180
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5296,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5024 /prefetch:8
        7⤵
        
        PID:3608
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5380,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5264 /prefetch:8
        7⤵
        
        PID:2180
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5232,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4704 /prefetch:8
        7⤵
        
        PID:4296
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5384,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5220 /prefetch:8
        7⤵
        
        PID:5356
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5616,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5636 /prefetch:2
        7⤵
        
        PID:7252
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=860,i,5590776906634060397,14790665005466484277,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5636 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5232
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 62616376636b2_Thu14254a34538.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\62616376636b2_Thu14254a34538.exe
        
        62616376636b2_Thu14254a34538.exe
        5⤵
        Looks for VirtualBox Guest Additions in registry
        Looks for VMWare Tools registry key
        Checks BIOS information in registry
        Executes dropped EXE
        Maps connected drives based on registry
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\7zS412208B7\62616376636b2_Thu14254a34538.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS412208B7\62616376636b2_Thu14254a34538.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2120 -ip 2120
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2196 -ip 2196
1⤵
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3720 -ip 3720
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3720 -ip 3720
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3720 -ip 3720
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3720 -ip 3720
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3720 -ip 3720
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3720 -ip 3720
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3720 -ip 3720
1⤵
PID:3752

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3720 -ip 3720
1⤵
PID:6436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion