darkcomet | hxxps://www[.]youtube[.]com/redirect?event=video_description&redir_token=QUFFLUhqbERIZjhRcm4yYVU5aVlxcW1mcUtqMUt4eUstQXxBQ3Jtc0tta25wUWE5T01ZWEFtaURraU1hengxcjRyVEZoWmVuS3dGZkJxMGJfQUlsanYzV1dKNmNTdllDZHFKdlRMdjVSV18zNGRpd0pXUXdOTnhmOWFqcG1GbXJIQXo4Y2ZwcXhjdVNNTWlXUFllZ25NMXB6VQ&q=https%3A%2F%2Fgithub[.]com%2FAmsterdamA1%2FAmsterdam%2Freleases%2Fdownload%2F2[.]0%2FSetup[.]Program[.]zip&v=nSi4avg7vM4

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	Process
5332	chrome.exe
4412	chrome.exe
5948	chrome.exe
3492	chrome.exe
6132	chrome.exe
5472	chrome.exe
3432	chrome.exe
4852	chrome.exe

Executes dropped EXE 4 IoCs

Processes:

pythonw.exepythonw.exepythonw.exepythonw.exe

pid	Process
5228	pythonw.exe
2824	pythonw.exe
6128	pythonw.exe
696	pythonw.exe

Loads dropped DLL 16 IoCs

Processes:

pythonw.exepythonw.exe

pid	Process
5228	pythonw.exe
5228	pythonw.exe
5228	pythonw.exe
5228	pythonw.exe
5228	pythonw.exe
5228	pythonw.exe
5228	pythonw.exe
5228	pythonw.exe
6128	pythonw.exe
6128	pythonw.exe
6128	pythonw.exe
6128	pythonw.exe
6128	pythonw.exe
6128	pythonw.exe
6128	pythonw.exe
6128	pythonw.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

pythonw.exepythonw.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet server = "C:\\Users\\Admin\\AppData\\Roaming\\pythonw.exe C:\\Users\\Admin\\AppData\\Roaming\\1890.py"	pythonw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google server = "C:\\Users\\Admin\\AppData\\Roaming\\pythonw.exe C:\\Users\\Admin\\AppData\\Roaming\\1890.py"	pythonw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet server = "C:\\Users\\Admin\\AppData\\Roaming\\pythonw.exe C:\\Users\\Admin\\AppData\\Roaming\\1890.py"	pythonw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google server = "C:\\Users\\Admin\\AppData\\Roaming\\pythonw.exe C:\\Users\\Admin\\AppData\\Roaming\\1890.py"	pythonw.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

pythonw.exepythonw.exepythonw.exepythonw.exepythonw.exepythonw.exe

description	pid	Process	procid_target
PID 2812 set thread context of 2192	2812	pythonw.exe	109
PID 1244 set thread context of 992	1244	pythonw.exe	111
PID 5228 set thread context of 2824	5228	pythonw.exe	115
PID 1144 set thread context of 3684	1144	pythonw.exe	140
PID 1404 set thread context of 3760	1404	pythonw.exe	144
PID 6128 set thread context of 696	6128	pythonw.exe	148

Drops file in Windows directory 7 IoCs

Processes:

setup.exesetup.exechrome.exechrome.exechrome.exechrome.exe

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

pythonw.exepythonw.exepythonw.exetimeout.exepythonw.exepythonw.exetimeout.exeAmsterdam.exepythonw.execmd.exepythonw.execmd.exeAmsterdam.exepythonw.exepythonw.execmd.execmd.exepythonw.exepythonw.exepythonw.exepythonw.exepythonw.exepythonw.exeDllHost.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amsterdam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amsterdam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

pythonw.exepythonw.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pythonw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pythonw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pythonw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pythonw.exe

Delays execution with timeout.exe 2 IoCs

evasion

Processes:

timeout.exetimeout.exe

pid	Process
1616	timeout.exe
1872	timeout.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exechrome.exechrome.exechrome.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133771176590532110"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

Processes:

explorer.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "Automatische Wiedergabe"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "3"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Wiederherstellung"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Center für erleichterte Bedienung"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Anmeldeinformationsverwaltung"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Telefon und Modem"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\sud.dll,-1#immutable1 = "Standardprogramme"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Energieoptionen"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp- und Desktopverbindungen"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Bewahren Sie einen Verlauf Ihrer Dateien auf"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "2"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\main.cpl,-100#immutable1 = "Maus"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Ändern Sie Benutzerkontoeinstellungen und Kennwörter für Personen, die diesen Computer gemeinsam nutzen."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\main.cpl,-101#immutable1 = "Passt Mauseinstellungen, wie z. B. Schaltflächenkonfiguration, Doppelklickgeschwindigkeit, Mauszeiger oder Bewegungsgeschwindigkeit, an."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "Zeigt Informationen über den Computer an und ändert Einstellungen für Hardware, Leistung und Remoteverbindungen."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "Dateiversionsverlauf"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Konfiguriert Wählregeln zum Telefonieren und Modemeinstellungen."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Deinstallieren oder ändern Sie Programme auf dem Computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Schützen Sie den PC durch die BitLocker-Laufwerkverschlüsselung."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "Benutzerkonten"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Überprüfen Sie den Netzwerkstatus, ändern Sie Netzwerkeinstellungen, und legen Sie Einstellungen für die Freigabe von Dateien und Druckern fest."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programme und Features"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Ändern der Indizierungsart zur Beschleunigung der Suche"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Ändern Sie die Standardeinstellungen für CDs, DVDs und Geräte, so dass automatisch Musik wiedergegeben, Bilder angezeigt, Software installiert und Spiele gespielt werden können."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internetoptionen"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Kopien von Dateien, die unter Windows 7 gesichert wurden, wiederherstellen"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Erleichtern Sie die Bedienung des Computers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Legt Firewallsicherheitsoptionen fest, um zum Schutz des Computers vor Hackern und böswilliger Software beizutragen."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Sichern und Wiederherstellen (Windows 7)"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 0c0001008421de39050000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Geräte-Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Internetanzeige- und -verbindungseinstellungen konfigurieren"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "Zeigt Geräte, Drucker und Druckaufträge an und verwaltet sie."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Problembehandlung"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\ImmutableMuiCache\Strings\67BDC06\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indizierungsoptionen"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid	Process
1380	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exepythonw.exechrome.exetaskmgr.exe

pid	Process
1176	chrome.exe
1176	chrome.exe
992	pythonw.exe
992	pythonw.exe
992	pythonw.exe
992	pythonw.exe
3492	chrome.exe
3492	chrome.exe
992	pythonw.exe
992	pythonw.exe
992	pythonw.exe
992	pythonw.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid	Process
5272	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exe

pid	Process
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe
2632	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	Process
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	Process
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	Process
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pythonw.exeSecHealthUI.exe

pid	Process
2824	pythonw.exe
1144	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 1176 wrote to memory of 1508	1176	chrome.exe	81
PID 1176 wrote to memory of 1508	1176	chrome.exe	81
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 4640	1176	chrome.exe	82
PID 1176 wrote to memory of 1188	1176	chrome.exe	83
PID 1176 wrote to memory of 1188	1176	chrome.exe	83
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84
PID 1176 wrote to memory of 5788	1176	chrome.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbERIZjhRcm4yYVU5aVlxcW1mcUtqMUt4eUstQXxBQ3Jtc0tta25wUWE5T01ZWEFtaURraU1hengxcjRyVEZoWmVuS3dGZkJxMGJfQUlsanYzV1dKNmNTdllDZHFKdlRMdjVSV18zNGRpd0pXUXdOTnhmOWFqcG1GbXJIQXo4Y2ZwcXhjdVNNTWlXUFllZ25NMXB6VQ&q=https%3A%2F%2Fgithub.com%2FAmsterdamA1%2FAmsterdam%2Freleases%2Fdownload%2F2.0%2FSetup.Program.zip&v=nSi4avg7vM4
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffae80dcc40,0x7ffae80dcc4c,0x7ffae80dcc58
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1976,i,9598567782039676295,7791196840401062391,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1864,i,9598567782039676295,7791196840401062391,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,9598567782039676295,7791196840401062391,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2264 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,9598567782039676295,7791196840401062391,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,9598567782039676295,7791196840401062391,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4624,i,9598567782039676295,7791196840401062391,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4904,i,9598567782039676295,7791196840401062391,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5188,i,9598567782039676295,7791196840401062391,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5004,i,9598567782039676295,7791196840401062391,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3256 /prefetch:8
  2⤵
  PID:5724

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4840

C:\Users\Admin\Downloads\Setup.Program\Amsterdam.exe
"C:\Users\Admin\Downloads\Setup.Program\Amsterdam.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3760
- C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
  "pythonw.exe" "aynchat.dll"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4864
- C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
  "pythonw.exe" "python.dll"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2812
- - C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
    "pythonw.exe"
    3⤵
    PID:1912
- - C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
    "pythonw.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2192
- C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
  "pythonw.exe" "server.dll"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1244
- - C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
    "pythonw.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:3492
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x224,0x228,0x22c,0x1fc,0x230,0x7ffae80dcc40,0x7ffae80dcc4c,0x7ffae80dcc58
        5⤵
        
        PID:5108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2300,i,15498368168792907716,8003046773242108501,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2308 /prefetch:2
        5⤵
        
        PID:5212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1892,i,15498368168792907716,8003046773242108501,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2460 /prefetch:3
        5⤵
        
        PID:5524
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2040,i,15498368168792907716,8003046773242108501,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2568 /prefetch:8
        5⤵
        
        PID:768
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3228,i,15498368168792907716,8003046773242108501,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6132
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3248,i,15498368168792907716,8003046773242108501,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3272 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5472
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3232,i,15498368168792907716,8003046773242108501,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4500 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3432
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4840,i,15498368168792907716,8003046773242108501,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4860 /prefetch:8
        5⤵
        
        PID:6040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4876,i,15498368168792907716,8003046773242108501,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4856 /prefetch:8
        5⤵
        
        PID:5096
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FIDGHIIECGHD" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:2540
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\setup.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2904
- - C:\Users\Admin\AppData\Roaming\pythonw.exe
    C:\Users\Admin\AppData\Roaming\pythonw.exe C:\Users\Admin\AppData\Roaming\1890.py
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:5228
  - - C:\Users\Admin\AppData\Roaming\pythonw.exe
      "C:\Users\Admin\AppData\Roaming\pythonw.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2824

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2488

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:5272

C:\Users\Admin\Downloads\Setup.Program\Amsterdam.exe
"C:\Users\Admin\Downloads\Setup.Program\Amsterdam.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4712
- C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
  "pythonw.exe" "aynchat.dll"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4152
- C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
  "pythonw.exe" "python.dll"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1144
- - C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
    "pythonw.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3684
- C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
  "pythonw.exe" "server.dll"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1404
- - C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
    "pythonw.exe"
    3⤵
    PID:3248
- - C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
    "pythonw.exe"
    3⤵
    PID:5420
- - C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
    "pythonw.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:3760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:4852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffad82ecc40,0x7ffad82ecc4c,0x7ffad82ecc58
        5⤵
        
        PID:5588
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,7987944926675269420,11942225084169875596,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1988 /prefetch:2
        5⤵
        
        PID:5644
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1896,i,7987944926675269420,11942225084169875596,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2064 /prefetch:3
        5⤵
        
        PID:1812
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,7987944926675269420,11942225084169875596,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2280 /prefetch:8
        5⤵
        
        PID:2948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,7987944926675269420,11942225084169875596,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3192 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,7987944926675269420,11942225084169875596,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3224 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4160,i,7987944926675269420,11942225084169875596,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4544 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4784,i,7987944926675269420,11942225084169875596,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4832 /prefetch:8
        5⤵
        
        PID:4748
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4872,i,7987944926675269420,11942225084169875596,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4896 /prefetch:8
        5⤵
        
        PID:1080
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FBKKFBAEGDHJ" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:1744
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\setup.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1824
- - C:\Users\Admin\AppData\Roaming\pythonw.exe
    C:\Users\Admin\AppData\Roaming\pythonw.exe C:\Users\Admin\AppData\Roaming\1890.py
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:6128
  - - C:\Users\Admin\AppData\Roaming\pythonw.exe
      "C:\Users\Admin\AppData\Roaming\pythonw.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:696

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2864

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1144

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4984

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5716

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5940

C:\Users\Admin\Downloads\Setup.Program\pythonw.exe
"C:\Users\Admin\Downloads\Setup.Program\pythonw.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ffad917cc40,0x7ffad917cc4c,0x7ffad917cc58
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2056,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1960,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2328,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2204 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3144,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4620,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4356,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3292,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3156 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3220,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5012,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4892,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4992,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5080,i,8280555926026937892,14411364648484472027,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5164 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Windows directory
  PID:4500
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff665354698,0x7ff6653546a4,0x7ff6653546b0
    3⤵
    - Drops file in Windows directory
    PID:4012

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5812

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:1380

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

Modify Registry

T1112

Credential Access

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery