meshagent | 1e383a0e7990c73ea2856ee1d0204f99728cd58f0b30a288e12081dc7cb3a8f1

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	agent_out.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 13 IoCs

pid	Process
4584	agent_out.exe
2004	MeshAgent.exe
2204	software.exe
1904	VMware-viclient.exe
1288	vcredist_x86.exe
4084	install.exe
1204	vcredist_x64.exe
1208	install.exe
3200	vjredist64.exe
4364	install.exe
4852	vnetlib64.exe
3544	vnetlib64.exe
1400	vnetlib64.exe

Loads dropped DLL 64 IoCs

pid	Process
408	MsiExec.exe
408	MsiExec.exe
408	MsiExec.exe
408	MsiExec.exe
408	MsiExec.exe
408	MsiExec.exe
408	MsiExec.exe
408	MsiExec.exe
4084	install.exe
1208	install.exe
408	MsiExec.exe
4364	install.exe
1712	MsiExec.exe
1008	MsiExec.exe
1712	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1712	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe
1008	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vjredist64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
15	3212	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	MsiExec.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e66f603f-4483-0f4a-9465-2349690303cb}\SET56E1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmusb.inf_amd64_aeb12e4f8fbff559\vmusb.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shell32.pdb	MeshAgent.exe
File created	C:\Windows\SysWOW64\msvcp71.dll	msiexec.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\iphlpapi.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\D51242473009F9555AFDA05A9BA0E4013499E83A	MeshAgent.exe
File created	C:\Windows\SysWOW64\mfc71u.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e66f603f-4483-0f4a-9465-2349690303cb}\vmusb.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\dbghelp.pdb	MeshAgent.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\user32.pdb	MeshAgent.exe
File created	C:\Windows\System32\DriverStore\Temp\{e66f603f-4483-0f4a-9465-2349690303cb}\SET56D1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\symbols\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\A677F586FD9587261964BB43C72ED3DF186C995B	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e66f603f-4483-0f4a-9465-2349690303cb}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e66f603f-4483-0f4a-9465-2349690303cb}\SET56E2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\symbols\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\0FE279A8C0C37773D35A768336FFA92772FE5DE2	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e66f603f-4483-0f4a-9465-2349690303cb}\vmusb.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\bcrypt.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\0FE279A8C0C37773D35A768336FFA92772FE5DE2	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e66f603f-4483-0f4a-9465-2349690303cb}\SET56E2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32full.pdb	MeshAgent.exe
File created	C:\Windows\SysWOW64\msvcr71.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e66f603f-4483-0f4a-9465-2349690303cb}\SET56D1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmusb.inf_amd64_aeb12e4f8fbff559\vmusb.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\9C7FD82D9F028E67151F7A1CD5DDDF8A25550C81	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32full.pdb	MeshAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmclientcore.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\iconv.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\sigc-2.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\libeay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\USB\vnetlib64.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\ja\VpxClientHtmlResources.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\glib-2.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmwarestring.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\libcurl.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\intl.dll	msiexec.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\de\VpxClientHtmlResources.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\fr\VimVmomi.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmdbcom.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\VimUiFramework.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\zh-TW\VpxClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\de\VpxClientCommon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\fr\VMware.CustomControls.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\ko\VimClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\liblber.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\authdcnx.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\de\SearchLibrary.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\ja\SearchControls.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vmusb.cat	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\glib-2.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\libcurl.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\ESXAgentManager.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\QueryService.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Help\EULA-de.rtf	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\fr\VimSearchUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\zh-CN\VpxClientCommon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\glib-2.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\libldap.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\zh-CN\VI.resources.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\zh-CN\QueryService.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\gvmomi.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\de\QueryService.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\es\VpxClientHtmlResources.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\open_source_licenses.txt	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\ja\SearchLibrary.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\dbghelp.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\iconv.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Help\EULA-es.rtf	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\vmwarewui.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\vmdbcom.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\open_source_licenses.txt	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\zh-TW\SearchControls.resources.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Help\EULA-ja.rtf	msiexec.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.msh	MeshAgent.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\glibmm-2.4.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\USB\vmusb.cat	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Firefox\liblber.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\es\VpxClientGraphics.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Help\README-zh-CN.TXT	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\gobject-2.0.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\ja\VpxClientCommon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\VMware.CustomControls.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmwarebase.dll	msiexec.exe
File created	C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\6.0\VpxClient.SSPI.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GACLock.dat	MsiExec.exe
File created	C:\Windows\assembly\tmp\5ZY4HSUI\vjswfchtml.dll	MsiExec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSIFBC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1779.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.lock	ngen.exe
File opened for modification	C:\Windows\assembly	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI13E3.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220659196.2\9.0.30729.4148.policy	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\1007C6B46D7C017319E3B52CF3EC196E\9.0.30729\FL_msdia71_dll_2_60035_amd64_ln.3643236F_FC70_11D3_A536_0090278A1BB8	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20250101220702196.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5C.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vjslib.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE9.tmp	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\YKHTPFPN7Q\vjssupuilib.dll	MsiExec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)\globdata.ini	msiexec.exe
File created	C:\Windows\assembly\ngenlock.dat	MsiExec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220702196.1\9.0.30729.4148.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1E.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220659165.0\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220702180.0\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_22d6ba8a.cat	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vjslibcw.dll	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDAE8716E7E2FDF99.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1915.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220750107.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)\install.res.1046.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220659165.0\mfc90esp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220702165.1\mfc90chs.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB0C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1492.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20250101220750201.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220659149.0\msvcr90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20250101220659212.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220702165.1\mfc90fra.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47D8.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220750107.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220702165.0\mfcm90.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE70.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI119A.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220659165.0\mfc90rus.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCD.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220659149.1\mfc90u.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)\eula.1049.txt	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\YKHTPFPN7Q\vjsjbc.dll	MsiExec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220659149.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACF9.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\5ZY4HSUI\vjssupuilib.dll	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI5440.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220702118.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_673f7fa2.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3E.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.lock	ngen.exe
File opened for modification	C:\Windows\Installer\MSI1355.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58C6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID4B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI103C.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vjscor.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250101220659165.0\mfc90esn.dll	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2848	powershell.exe
1912	powershell.exe
3176	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	software.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VMware-viclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vjredist64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks SCSI registry key(s) 3 TTPs 31 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001d3755855d3e98e80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001d3755850000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001d375585000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1d375585000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001d37558500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133802427742877872"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5C639832-EB27-36B2-8C36-D0D3741653A5}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{2E945797-82D1-34B2-A20E-1E3426A264E2}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B64A3013-9A01-32D5-AB76-262B4476310D}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4339C284-85D3-321B-9549-1564A4860276}\TypeLib\ = "{74D636D5-60FD-3326-BD99-BCA8485FF66E}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{767079CA-EF48-3167-BDA9-FE16889DE935}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CBE620B9-E8F8-3E89-B74B-C85D51C505BC}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2D660BF-248B-30FD-A3AD-542A3975CBBE}\ = "_com_ms_win32_FORMATRANGE"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC33D30E-0811-353F-A020-D3201DEF55FA}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{6F507D27-60A1-32B7-9DEA-74F335BA82A6}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F42A312-5754-35EB-947D-D93BE775B522}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48567A9A-25D3-38C5-93B7-3FC4DADA7B66}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{34C346C0-15B7-3543-ADD1-94AD29D78F27}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1C30F69-4A96-3B1F-991D-E11B4F21BEE3}\TypeLib\Version = "2.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80096C7D-092A-3F01-B367-D27F0F54AAAA}\ = "_HIGHCONTRAST"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F6AB880-3022-3FEF-858F-718164271B6B}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7FD42A75-0FA2-325B-8A69-AEE53F5FB3DF}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03B1A22F-7C09-398F-A087-3B6F79E7749B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9D283E4-5C20-3761-86E6-030C71474434}\TypeLib\ = "{74D636D5-60FD-3326-BD99-BCA8485FF66E}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{476C693F-9959-3D65-9A36-D508AD8B6852}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{31520681-0A59-3382-9405-3202D9406C2F}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{2279B930-DA7F-3CC7-8443-DBD973637408}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B8AB75B3-9592-3F7C-BEB2-2FF2C16D5615}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED2F493E-1651-333C-A704-C99AC1C1BA45}\TypeLib\ = "{E710FA11-6607-32BA-8C1A-2015DED1B85B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{339C1579-28AD-37D9-A579-3485E32A57B1}\ = "_BufferedInputStream"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{835E5509-7706-3DB6-A23B-B902CADD2E71}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2611ACED-83D1-3180-8D3F-9D2270B22F4D}\TypeLib\ = "{74D636D5-60FD-3326-BD99-BCA8485FF66E}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20D3C758-6009-37AB-8040-31648C48B4AF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{348AFF13-F3E3-31E1-B1F7-F99C86E0B641}\TypeLib\ = "{E710FA11-6607-32BA-8C1A-2015DED1B85B}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F353F8BE-2778-30A5-BF74-3E614183D839}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{530946BF-10F4-3D19-A7C1-04EC8F127C42}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89CBC39F-3146-3E70-874A-A5954CACF6E8}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD5A735C-9781-33F2-8FD5-BB468EEEA349}\TypeLib\Version = "2.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9174102E-09BF-3F90-A926-CF644700E3E0}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2088175C-CC37-3723-899C-49656FEF996E}\TypeLib\ = "{E710FA11-6607-32BA-8C1A-2015DED1B85B}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9C8507EE-1F00-355B-9BC2-06EB75866AE6}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{278FB2D3-09A8-3889-88B9-6B51C50C2E84}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F53F71DD-E79B-3EF9-9CE3-3B2FF7862A5A}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{070315A7-9488-35FB-BA37-5010C5E4D918}\TypeLib\Version = "2.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5A66A8D5-ADA6-3CFC-B5A0-3E7BB0C711FF}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0CA16C1-0080-386E-B2BE-9826E3A74739}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0528988E-C509-39D2-9DB9-637D13CA07A1}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA3A449E-8655-36DF-9C50-A82EAF20E507}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9042FDF8-29BC-3655-9B01-DF6482D5F65A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE914D61-2EC8-3E62-9911-7BEC74787754}\TypeLib\ = "{E710FA11-6607-32BA-8C1A-2015DED1B85B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F0CEB0B-432A-33D1-83D4-FDDA73959D54}\TypeLib\ = "{74D636D5-60FD-3326-BD99-BCA8485FF66E}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F8CF56A0-D329-3CA1-BC21-93A2B42F3860}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{278FB2D3-09A8-3889-88B9-6B51C50C2E84}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5C1C58CD-48AF-3B52-A468-7EAB4FC2EB8D}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6ACEEB7A-7624-3FEC-AD26-E2E410DCBAB3}\TypeLib\Version = "2.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{19E77BFE-0010-3028-8631-8186AB8E2BBA}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5B49CBBF-6541-3364-A856-AE2BEED86840}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E2257F2-7D71-3A57-8DE0-6FFE53587689}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31C0D349-F2C7-3857-AF2C-B24BA8BB6318}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC578574-C640-355C-BA3C-920AF2D544CD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7941C839-DE7C-331D-86F6-8C06B5888BC6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{76DEF5E3-06A3-3721-AF71-262B69D59448}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{653F89A3-212E-3714-BC48-A8F441DC4FC3}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{A06290FB-26FF-3E88-B5A9-D40302DBF4BA}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{EC8CBB5A-0AC8-39DE-805D-85CC9043F429}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E95255A-F5EA-3807-BEB2-FF455A9106BE}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50097C24-ED42-372D-BECB-85B675C9DB96}\TypeLib\Version = "2.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3C5677-621A-3B15-81F9-963AE1A90CA0}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1A66A95A-60E7-3379-AC5C-152D703304D6}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1FC3E83D-08B8-3F19-962B-8780A077F7C6}\TypeLib	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\eicar_com.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe
3176	powershell.exe
3176	powershell.exe
3176	powershell.exe
2848	powershell.exe
2848	powershell.exe
2848	powershell.exe
1912	powershell.exe
1912	powershell.exe
1912	powershell.exe
408	MsiExec.exe
408	MsiExec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4840	chrome.exe
4840	chrome.exe
4260	chrome.exe
4260	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeAssignPrimaryTokenPrivilege	900	wmic.exe
Token: SeIncreaseQuotaPrivilege	900	wmic.exe
Token: SeSecurityPrivilege	900	wmic.exe
Token: SeTakeOwnershipPrivilege	900	wmic.exe
Token: SeLoadDriverPrivilege	900	wmic.exe
Token: SeSystemtimePrivilege	900	wmic.exe
Token: SeBackupPrivilege	900	wmic.exe
Token: SeRestorePrivilege	900	wmic.exe
Token: SeShutdownPrivilege	900	wmic.exe
Token: SeSystemEnvironmentPrivilege	900	wmic.exe
Token: SeUndockPrivilege	900	wmic.exe
Token: SeManageVolumePrivilege	900	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	900	wmic.exe
Token: SeIncreaseQuotaPrivilege	900	wmic.exe
Token: SeSecurityPrivilege	900	wmic.exe
Token: SeTakeOwnershipPrivilege	900	wmic.exe
Token: SeLoadDriverPrivilege	900	wmic.exe
Token: SeSystemtimePrivilege	900	wmic.exe
Token: SeBackupPrivilege	900	wmic.exe
Token: SeRestorePrivilege	900	wmic.exe
Token: SeShutdownPrivilege	900	wmic.exe
Token: SeSystemEnvironmentPrivilege	900	wmic.exe
Token: SeUndockPrivilege	900	wmic.exe
Token: SeManageVolumePrivilege	900	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	656	wmic.exe
Token: SeIncreaseQuotaPrivilege	656	wmic.exe
Token: SeSecurityPrivilege	656	wmic.exe
Token: SeTakeOwnershipPrivilege	656	wmic.exe
Token: SeLoadDriverPrivilege	656	wmic.exe
Token: SeSystemtimePrivilege	656	wmic.exe
Token: SeBackupPrivilege	656	wmic.exe
Token: SeRestorePrivilege	656	wmic.exe
Token: SeShutdownPrivilege	656	wmic.exe
Token: SeSystemEnvironmentPrivilege	656	wmic.exe
Token: SeUndockPrivilege	656	wmic.exe
Token: SeManageVolumePrivilege	656	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	656	wmic.exe
Token: SeIncreaseQuotaPrivilege	656	wmic.exe
Token: SeSecurityPrivilege	656	wmic.exe
Token: SeTakeOwnershipPrivilege	656	wmic.exe
Token: SeLoadDriverPrivilege	656	wmic.exe
Token: SeSystemtimePrivilege	656	wmic.exe
Token: SeBackupPrivilege	656	wmic.exe
Token: SeRestorePrivilege	656	wmic.exe
Token: SeShutdownPrivilege	656	wmic.exe
Token: SeSystemEnvironmentPrivilege	656	wmic.exe
Token: SeUndockPrivilege	656	wmic.exe
Token: SeManageVolumePrivilege	656	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	2844	wmic.exe
Token: SeIncreaseQuotaPrivilege	2844	wmic.exe
Token: SeSecurityPrivilege	2844	wmic.exe
Token: SeTakeOwnershipPrivilege	2844	wmic.exe
Token: SeLoadDriverPrivilege	2844	wmic.exe
Token: SeSystemtimePrivilege	2844	wmic.exe
Token: SeBackupPrivilege	2844	wmic.exe
Token: SeRestorePrivilege	2844	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
1904	VMware-viclient.exe
1836	MSIEXEC.EXE
1836	MSIEXEC.EXE
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3416	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 4944	2760	chrome.exe	83
PID 2760 wrote to memory of 4944	2760	chrome.exe	83
PID 4960 wrote to memory of 4584	4960	VMware-viclient-f0c1e456.exe	84
PID 4960 wrote to memory of 4584	4960	VMware-viclient-f0c1e456.exe	84
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 4480	2760	chrome.exe	87
PID 2760 wrote to memory of 2352	2760	chrome.exe	88
PID 2760 wrote to memory of 2352	2760	chrome.exe	88
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89
PID 2760 wrote to memory of 3228	2760	chrome.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VMware-viclient-f0c1e456.exe
"C:\Users\Admin\AppData\Local\Temp\VMware-viclient-f0c1e456.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\Temp\agent_out.exe
  "C:\Windows\Temp\agent_out.exe" -fullinstall
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  PID:4584
- C:\Windows\Temp\software.exe
  "C:\Windows\Temp\software.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\7zSDC08.tmp\bin\VMware-viclient.exe
    .\bin\VMware-viclient.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1904
  - - C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{06497AFB-9894-4D10-9687-335B18B5A25E}\VMware vSphere Client 6.0.msi" /L*v "C:\Users\Admin\AppData\Local\Temp\vim-vic-msi.log" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\{06497AFB-9894-4D10-9687-335B18B5A25E}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\7zSDC08.tmp\bin" SETUPEXENAME="VMware-viclient.exe"
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\{593390AC-CACE-4278-AA77-350012BF10B1}\vcredist_x86.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{593390AC-CACE-4278-AA77-350012BF10B1}\vcredist_x86.exe" /q
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1288
      - \??\c:\50e6f6e95277a3f412\install.exe
        
        c:\50e6f6e95277a3f412\.\install.exe /q
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\{593390AC-CACE-4278-AA77-350012BF10B1}\vcredist_x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{593390AC-CACE-4278-AA77-350012BF10B1}\vcredist_x64.exe" /q
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1204
      - \??\c:\76ee9abacf6e57bfc84b6c1f4d73a0\install.exe
        
        c:\76ee9abacf6e57bfc84b6c1f4d73a0\.\install.exe /q
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff927f6cc40,0x7ff927f6cc4c,0x7ff927f6cc58
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1768,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3556,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4412,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4956,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4948,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4348,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3568,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5188,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4968,i,10445566649942197142,11174185414802147085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4972 /prefetch:2
  2⤵
  PID:352

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4112

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:2004
- C:\Windows\System32\wbem\wmic.exe
  wmic SystemEnclosure get ChassisTypes
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:656
- C:\Windows\System32\wbem\wmic.exe
  wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  PID:3584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1912
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get C -Type recoverypassword
  2⤵
  PID:872
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get C -Type recoverypassword
    3⤵
    PID:1620
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get F -Type recoverypassword
  2⤵
  PID:3668
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get F -Type recoverypassword
    3⤵
    PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2976

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3212
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D1233A877F54EE5B8B3F5A076427E077 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- - C:\Users\Admin\AppData\Local\Temp\7zSDC08.tmp\redist\vjredist\x64\vjredist64.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSDC08.tmp\bin\..\redist\vjredist\x64\vjredist64.exe" /q /c:"install /q /l"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.exe
      install /q /l
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4364
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E6B76E80BDB68F53F85D19B38F40E85A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1712
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "Microsoft.Build.VisualJSharp, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4908
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "VjsWfcBrowserStubLib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:924
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "vjscor, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4524
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "VJSharpCodeProvider, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3228
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "vjslib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4276
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "vjslibcw, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1004
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "VJSSupUILib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1060
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "vjswfc, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3896
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "vjswfccw, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:352
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "vjswfchtml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2096
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "vjsjbc, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1940
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe install "vjsvwaux, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:872
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe update /queue
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4112
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EB29ACBEDD2A6B3A289BC8F31F714708
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  PID:1008
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe install "Microsoft.Build.VisualJSharp, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    PID:4972
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe install "vjscor, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    PID:3184
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe install "VJSharpCodeProvider, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - Drops file in Windows directory
    PID:124
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe install "vjslib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - Drops file in Windows directory
    PID:920
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe install "vjslibcw, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - Drops file in Windows directory
    PID:4336
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe install "VJSSupUILib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - Drops file in Windows directory
    PID:4312
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe install "vjsjbc, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    PID:1016
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe install "vjsvwaux, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /NoDependencies /queue:3 /nologo
    3⤵
    - Drops file in Windows directory
    PID:4412
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe update /queue
    3⤵
    PID:952
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 90CCC72CD0E906A0FCC1E4C0A750A502
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.5\Internet Explorer\vmwareRemoteConsole.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1452
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 790BA032FE0DF58368D908F58B94EA8D E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4364
- - C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe
    "C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe" -- uninstall usb
    3⤵
    - Executes dropped EXE
    PID:4852
- - C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe
    "C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vnetlib64.exe" -- install usb
    3⤵
    - Executes dropped EXE
    PID:3544
- - C:\Program Files (x86)\Common Files\VMware\USB\vnetlib64.exe
    "C:\Program Files (x86)\Common Files\VMware\USB\vnetlib64.exe" -- install hcmon
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    PID:1400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
PID:3360
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files (x86)\Common Files\VMware\USB\DriverCache\vmusb.inf" "9" "4bd894f47" "0000000000000154" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Common Files\VMware\USB\DriverCache"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2532

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3416

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
PID:3152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff927f6cc40,0x7ff927f6cc4c,0x7ff927f6cc58
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1772,i,7245770888909593320,17734529366590549546,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2096,i,7245770888909593320,17734529366590549546,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2184,i,7245770888909593320,17734529366590549546,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=2192 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3052,i,7245770888909593320,17734529366590549546,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3096,i,7245770888909593320,17734529366590549546,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4468,i,7245770888909593320,17734529366590549546,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4772,i,7245770888909593320,17734529366590549546,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4816,i,7245770888909593320,17734529366590549546,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:1600

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1056

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
PID:5328

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5408

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff927f6cc40,0x7ff927f6cc4c,0x7ff927f6cc58
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1768,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=2040 /prefetch:3
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=2212 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3524,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4752,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:6108
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff74a394698,0x7ff74a3946a4,0x7ff74a3946b0
    3⤵
    PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4836,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3376,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3252,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3236,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5284,i,3992154391846018756,1200290007145950050,262144 --variations-seed-version=20241225-174432.450000 --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1868

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery