gurcu | a1af1cebcb9b024f05690fd07e65a7363e3bc0395cfc788102e9a907e76dda03

System Information Discovery

Processes:

svchost.exemsedgewebview2.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe

Drops startup file 3 IoCs

Processes:

svchost.exemsedgewebview2.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedgewebview2.exe.lnk	msedgewebview2.exe

Executes dropped EXE 34 IoCs

Processes:

JASON.exesvchost.exemsedgewebview2.exemsedgewebview2.exeJASON.exesvchost.exemsedgewebview2.exeJASON.exesvchost.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exe

pid	Process
1324	JASON.exe
1264	svchost.exe
208	msedgewebview2.exe
980	msedgewebview2.exe
364	JASON.exe
1376	svchost.exe
3032	msedgewebview2.exe
1388	JASON.exe
1356	svchost.exe
4528	msedgewebview2.exe
2412	msedgewebview2.exe
2264	msedgewebview2.exe
3392	msedgewebview2.exe
1916	msedgewebview2.exe
3284	msedgewebview2.exe
3688	msedgewebview2.exe
4684	msedgewebview2.exe
3896	msedgewebview2.exe
2028	msedgewebview2.exe
860	msedgewebview2.exe
116	msedgewebview2.exe
4456	msedgewebview2.exe
872	msedgewebview2.exe
2204	msedgewebview2.exe
4232	msedgewebview2.exe
4152	msedgewebview2.exe
5036	msedgewebview2.exe
4512	msedgewebview2.exe
3804	msedgewebview2.exe
864	msedgewebview2.exe
2764	msedgewebview2.exe
5004	msedgewebview2.exe
3456	msedgewebview2.exe
3152	msedgewebview2.exe

Loads dropped DLL 3 IoCs

Processes:

JASON.exeJASON.exeJASON.exe

pid	Process
1324	JASON.exe
364	JASON.exe
1388	JASON.exe

Drops file in System32 directory 11 IoCs

Processes:

svchost.exe

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

JASON.exeJASON.exeJASON.exe

pid	Process
1324	JASON.exe
364	JASON.exe
1388	JASON.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
3024	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133769479481880275"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

Processes:

chrome.exemspaint.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	mspaint.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
2084	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exe

pid	Process
792	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

svchost.exemsedgewebview2.exe

pid	Process
1264	svchost.exe
980	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

Processes:

powershell.exechrome.exeJASON.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exepowershell.exemspaint.exetaskmgr.exeJASON.exeJASON.exe

pid	Process
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
4936	chrome.exe
4936	chrome.exe
1324	JASON.exe
1324	JASON.exe
1324	JASON.exe
1324	JASON.exe
1344	powershell.exe
1344	powershell.exe
4304	powershell.exe
4304	powershell.exe
1744	powershell.exe
1744	powershell.exe
2136	powershell.exe
2136	powershell.exe
1264	svchost.exe
2008	powershell.exe
2008	powershell.exe
4524	mspaint.exe
4524	mspaint.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
364	JASON.exe
364	JASON.exe
364	JASON.exe
364	JASON.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
1388	JASON.exe
1388	JASON.exe
1388	JASON.exe
1388	JASON.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exe

pid	Process
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exechrome.exe

description	pid	Process
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	Process
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	Process
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

svchost.exemspaint.exeOpenWith.exe

pid	Process
1264	svchost.exe
4524	mspaint.exe
4732	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exechrome.exe

description	pid	Process	procid_target
PID 3460 wrote to memory of 1036	3460	cmd.exe	83
PID 3460 wrote to memory of 1036	3460	cmd.exe	83
PID 3460 wrote to memory of 1728	3460	cmd.exe	84
PID 3460 wrote to memory of 1728	3460	cmd.exe	84
PID 4936 wrote to memory of 4340	4936	chrome.exe	88
PID 4936 wrote to memory of 4340	4936	chrome.exe	88
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 228	4936	chrome.exe	89
PID 4936 wrote to memory of 3312	4936	chrome.exe	90
PID 4936 wrote to memory of 3312	4936	chrome.exe	90
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91
PID 4936 wrote to memory of 3304	4936	chrome.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AncelsPerformanceBatch.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "Set-ExecutionPolicy Unrestricted"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\system32\reg.exe
  reg add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:1728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb78b2cc40,0x7ffb78b2cc4c,0x7ffb78b2cc58
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2160,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4568,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4872,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4904,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5124,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4412,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5300,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5136,i,16573626838828461732,1810534662284876894,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:1376

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3416

C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON‌‌.exe
"C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON‌‌.exe"
1⤵
PID:2716
- C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON.exe
  "C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1324
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2136
- C:\ProgramData\msedgewebview2.exe
  "C:\ProgramData\msedgewebview2.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  PID:208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedgewebview2'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2008
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /create /tn msedgewebview2 /tr "C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe" /st 18:59 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:792
- - C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
    "C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    PID:980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7D44.tmp.cmd""
    3⤵
    PID:4208
  - - C:\Windows\system32\timeout.exe
      timeout 6
      4⤵
      Delays execution with timeout.exe
      PID:3024

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\CloseInstall.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4732

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\Build\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2084

C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON‌‌.exe
"C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON‌‌.exe"
1⤵
PID:2284
- C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON.exe
  "C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:364
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\ProgramData\msedgewebview2.exe
  "C:\ProgramData\msedgewebview2.exe"
  2⤵
  - Executes dropped EXE
  PID:3032

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:4320

C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON‌‌.exe
"C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON‌‌.exe"
1⤵
PID:1608
- C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON.exe
  "C:\Users\Admin\Downloads\JASONRAT_2.1.1.0\JASONRAT_2.1.1.0\JASON.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\ProgramData\msedgewebview2.exe
  "C:\ProgramData\msedgewebview2.exe"
  2⤵
  - Executes dropped EXE
  PID:4528

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:2264

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:1916

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:3284

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:3688

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:4684

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:3896

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:2028

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:860

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:116

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:4456

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:872

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:2204

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:4232

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:5036

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:4512

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:3804

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:864

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:2764

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:5004

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:3456

C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
C:\Users\Admin\AppData\Local\msedgewebview2\msedgewebview2.exe
1⤵
- Executes dropped EXE
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery