lumma | 680cb9fea15a1f1c5004abd791b1b27383640b985d0f95578871aeacd7d83d0a

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000800000002435e-4451.dat	family_xmrig
behavioral2/files/0x000800000002435e-4451.dat	xmrig

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (3325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Squirrelwaffle payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002425b-383.dat	squirrelwaffle

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	ApiUpdater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	$77-Bitdefender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	$77-Bitdefender.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ApiUpdater.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
129	5988	4363463463464363463463463.exe
133	5988	4363463463464363463463463.exe
135	5988	4363463463464363463463463.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	PCCooker_x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	Bomb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	ApiUpdater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0180b82.exe	explorer.exe

Executes dropped EXE 39 IoCs

pid	Process
2220	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
4944	PCCooker_x64.exe
5988	4363463463464363463463463.exe
2976	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
348	asena.exe
3404	Bomb.exe
2164	CryptoWall.exe
4532	TORRENTOLD-1.exe
5612	TORRENTOLD-1.exe
4740	ApiUpdater.exe
3004	25.exe
708	24.exe
8	23.exe
5980	22.exe
4284	21.exe
4528	20.exe
3772	19.exe
1564	18.exe
5476	17.exe
4504	16.exe
4720	15.exe
5020	14.exe
1192	13.exe
4300	12.exe
2324	10.exe
3416	11.exe
116	9.exe
2808	8.exe
3908	7.exe
5364	6.exe
4716	5.exe
5552	4.exe
5404	3.exe
3576	2.exe
428	1.exe
2892	xmbld.exe
6520	$77-Bitdefender.exe
4152	qqq.exe

Loads dropped DLL 15 IoCs

pid	Process
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
1680	DISCORD BIRTHDAY NITRO CLAIMER.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	ApiUpdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	$77-Bitdefender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	$77-Bitdefender.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a0180b8 = "C:\\a0180b82\\a0180b82.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a0180b82 = "C:\\Users\\Admin\\AppData\\Roaming\\a0180b82.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VisualStudioServer = "\"C:\\ProgramData\\Bitdefender\\$77-Bitdefender.exe\""	ApiUpdater.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	asena.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
132	raw.githubusercontent.com
133	raw.githubusercontent.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
105	api.ipify.org
136	ip-addr.es
139	ip-addr.es
153	ip-api.com
104	api.ipify.org

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	asena.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4532 set thread context of 5612	4532	TORRENTOLD-1.exe	203
PID 6520 set thread context of 6932	6520	$77-Bitdefender.exe	241
PID 4152 set thread context of 2272	4152	qqq.exe	283

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_EyeLashEye.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-96_altform-unplated.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-150_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_k_col.hxk	asena.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\RGNR_3A219DDE.txt	asena.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pt-BR\RGNR_3A219DDE.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-20.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_altform-unplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-72.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-125.png	asena.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms	asena.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\RGNR_3A219DDE.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MediumTile.scale-125_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\StoreLogo.scale-100.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_Resources\0.rsrc	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-96.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Thickness.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24.png	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\trdtv2r41.xsl	asena.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\RGNR_3A219DDE.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-125_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-60_altform-unplated.png	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sqlpdw.xsl	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-125.png	asena.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\RGNR_3A219DDE.txt	asena.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\RGNR_3A219DDE.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	asena.exe
File opened for modification	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui	asena.exe
File opened for modification	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui	asena.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms	asena.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\RGNR_3A219DDE.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-400.png	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui	asena.exe
File created	C:\Program Files\MSBuild\RGNR_3A219DDE.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\7.jpg	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-24_altform-unplated_contrast-black.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-200_contrast-white.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio_Model_CX.winmd	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-400.png	asena.exe
File opened for modification	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag	asena.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\RGNR_3A219DDE.txt	asena.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\WPGIMP32.FLT	asena.exe
File created	C:\Program Files\Windows Defender\de-DE\RGNR_3A219DDE.txt	asena.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	asena.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif	asena.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\kweather.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-24_contrast-white.png	asena.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0008000000024236-98.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
5540	3576	WerFault.exe	86
2600	3240	WerFault.exe	119
3560	3404	WerFault.exe	139
5292	5768	WerFault.exe	142
2148	2660	WerFault.exe	145
5420	3908	WerFault.exe	148
5108	4440	WerFault.exe	151
2288	5936	WerFault.exe	154
5248	5676	WerFault.exe	157
6064	4460	WerFault.exe	161
2076	4668	WerFault.exe	164
3020	3292	WerFault.exe	167
1160	1476	WerFault.exe	195
5244	3608	WerFault.exe	198
3732	4532	WerFault.exe	200

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asena.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qqq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCCooker_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TORRENTOLD-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ApiUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TORRENTOLD-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$77-Bitdefender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicSAGE.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	asena.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	asena.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003ace5ea140a78ecc0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003ace5ea10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003ace5ea1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3ace5ea1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003ace5ea100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	asena.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	asena.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	asena.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5032	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133869962932473916"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings	ApiUpdater.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
4316	reg.exe
5796	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1304	chrome.exe
1304	chrome.exe
5612	TORRENTOLD-1.exe
5612	TORRENTOLD-1.exe
5612	TORRENTOLD-1.exe
5612	TORRENTOLD-1.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2164	CryptoWall.exe
5664	explorer.exe
6520	$77-Bitdefender.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: 35	1680	DISCORD BIRTHDAY NITRO CLAIMER.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe
Token: SeCreatePagefilePrivilege	1272	chrome.exe
Token: SeShutdownPrivilege	1272	chrome.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
2892	xmbld.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe
1272	chrome.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3240	SonicSAGE.exe
3404	SonicSAGE.exe
5768	SonicSAGE.exe
2660	SonicSAGE.exe
3908	SonicSAGE.exe
4440	SonicSAGE.exe
5936	SonicSAGE.exe
5676	SonicSAGE.exe
4460	SonicSAGE.exe
4668	SonicSAGE.exe
3292	SonicSAGE.exe
1476	SonicSAGE.exe
3608	SonicSAGE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1308	1272	chrome.exe	105
PID 1272 wrote to memory of 1308	1272	chrome.exe	105
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 3200	1272	chrome.exe	106
PID 1272 wrote to memory of 1136	1272	chrome.exe	107
PID 1272 wrote to memory of 1136	1272	chrome.exe	107
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108
PID 1272 wrote to memory of 2876	1272	chrome.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 300
  2⤵
  - Program crash
  PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3576 -ip 3576
1⤵
PID:836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff4f35dcf8,0x7fff4f35dd04,0x7fff4f35dd10
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2024,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2256,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2420,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3244,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3260,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4484,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4500 /prefetch:2
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4680,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5340,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5576,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5744,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5704,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6156,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4960
- C:\Users\Admin\Downloads\DISCORD BIRTHDAY NITRO CLAIMER.exe
  "C:\Users\Admin\Downloads\DISCORD BIRTHDAY NITRO CLAIMER.exe"
  2⤵
  - Executes dropped EXE
  PID:2220
- - C:\Users\Admin\Downloads\DISCORD BIRTHDAY NITRO CLAIMER.exe
    "C:\Users\Admin\Downloads\DISCORD BIRTHDAY NITRO CLAIMER.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=240,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5592,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6148,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=6336,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5412,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6556,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6624,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5804,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4864,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6852,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3276,i,9278350037160375701,15811549589497545031,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:1296
- C:\Users\Admin\Downloads\PCCooker_x64.exe
  "C:\Users\Admin\Downloads\PCCooker_x64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4944
- - C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
    "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5988
  - - C:\Users\Admin\Downloads\Files\TORRENTOLD-1.exe
      "C:\Users\Admin\Downloads\Files\TORRENTOLD-1.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:4532
    - - C:\Users\Admin\Downloads\Files\TORRENTOLD-1.exe
        
        "C:\Users\Admin\Downloads\Files\TORRENTOLD-1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 796
        5⤵
        Program crash
        
        PID:3732
  - - C:\Users\Admin\Downloads\Files\ApiUpdater.exe
      "C:\Users\Admin\Downloads\Files\ApiUpdater.exe"
      4⤵
      Adds policy Run key to start application
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4740
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4316
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:5984
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Bitdefender\$77-Bitdefender.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6292
        
        C:\ProgramData\Bitdefender\$77-Bitdefender.exe
        
        C:\ProgramData\Bitdefender\$77-Bitdefender.exe
        7⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:6520
        
        C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6920
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        9⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5796
        
        \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        8⤵
        
        PID:6932
  - - C:\Users\Admin\Downloads\Files\xmbld.exe
      "C:\Users\Admin\Downloads\Files\xmbld.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      PID:2892
  - - C:\Users\Admin\Downloads\Files\qqq.exe
      "C:\Users\Admin\Downloads\Files\qqq.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:4152
    - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2272
- - C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
    "C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\asena.exe
    "C:\Users\Admin\AppData\Local\Temp\asena.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    PID:348
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic.exe shadowcopy delete
      4⤵
      PID:1976
  - - C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Bomb.exe
    "C:\Users\Admin\AppData\Local\Temp\Bomb.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\25.exe
      "C:\Users\Admin\AppData\Local\Temp\25.exe"
      4⤵
      Executes dropped EXE
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\24.exe
      "C:\Users\Admin\AppData\Local\Temp\24.exe"
      4⤵
      Executes dropped EXE
      PID:708
  - - C:\Users\Admin\AppData\Local\Temp\23.exe
      "C:\Users\Admin\AppData\Local\Temp\23.exe"
      4⤵
      Executes dropped EXE
      PID:8
  - - C:\Users\Admin\AppData\Local\Temp\22.exe
      "C:\Users\Admin\AppData\Local\Temp\22.exe"
      4⤵
      Executes dropped EXE
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\21.exe
      "C:\Users\Admin\AppData\Local\Temp\21.exe"
      4⤵
      Executes dropped EXE
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\20.exe
      "C:\Users\Admin\AppData\Local\Temp\20.exe"
      4⤵
      Executes dropped EXE
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\19.exe
      "C:\Users\Admin\AppData\Local\Temp\19.exe"
      4⤵
      Executes dropped EXE
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\18.exe
      "C:\Users\Admin\AppData\Local\Temp\18.exe"
      4⤵
      Executes dropped EXE
      PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\17.exe
      "C:\Users\Admin\AppData\Local\Temp\17.exe"
      4⤵
      Executes dropped EXE
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\16.exe
      "C:\Users\Admin\AppData\Local\Temp\16.exe"
      4⤵
      Executes dropped EXE
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\15.exe
      "C:\Users\Admin\AppData\Local\Temp\15.exe"
      4⤵
      Executes dropped EXE
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\14.exe
      "C:\Users\Admin\AppData\Local\Temp\14.exe"
      4⤵
      Executes dropped EXE
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\13.exe
      "C:\Users\Admin\AppData\Local\Temp\13.exe"
      4⤵
      Executes dropped EXE
      PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\12.exe
      "C:\Users\Admin\AppData\Local\Temp\12.exe"
      4⤵
      Executes dropped EXE
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\11.exe
      "C:\Users\Admin\AppData\Local\Temp\11.exe"
      4⤵
      Executes dropped EXE
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\10.exe
      "C:\Users\Admin\AppData\Local\Temp\10.exe"
      4⤵
      Executes dropped EXE
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\9.exe
      "C:\Users\Admin\AppData\Local\Temp\9.exe"
      4⤵
      Executes dropped EXE
      PID:116
  - - C:\Users\Admin\AppData\Local\Temp\8.exe
      "C:\Users\Admin\AppData\Local\Temp\8.exe"
      4⤵
      Executes dropped EXE
      PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\7.exe
      "C:\Users\Admin\AppData\Local\Temp\7.exe"
      4⤵
      Executes dropped EXE
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\6.exe
      "C:\Users\Admin\AppData\Local\Temp\6.exe"
      4⤵
      Executes dropped EXE
      PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\5.exe
      "C:\Users\Admin\AppData\Local\Temp\5.exe"
      4⤵
      Executes dropped EXE
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\4.exe
      "C:\Users\Admin\AppData\Local\Temp\4.exe"
      4⤵
      Executes dropped EXE
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\3.exe
      "C:\Users\Admin\AppData\Local\Temp\3.exe"
      4⤵
      Executes dropped EXE
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\2.exe
      "C:\Users\Admin\AppData\Local\Temp\2.exe"
      4⤵
      Executes dropped EXE
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      4⤵
      Executes dropped EXE
      PID:428
- - C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
    "C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:2164
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\syswow64\explorer.exe"
      4⤵
      Drops startup file
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      PID:5664
    - - C:\Windows\SysWOW64\svchost.exe
        
        -k netsvcs
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5528

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3416

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 292
  2⤵
  - Program crash
  PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3240 -ip 3240
1⤵
PID:5652

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 288
  2⤵
  - Program crash
  PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3404 -ip 3404
1⤵
PID:1172

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 292
  2⤵
  - Program crash
  PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5768 -ip 5768
1⤵
PID:4492

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 292
  2⤵
  - Program crash
  PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2660 -ip 2660
1⤵
PID:2400

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 296
  2⤵
  - Program crash
  PID:5420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3908 -ip 3908
1⤵
PID:4120

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 288
  2⤵
  - Program crash
  PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4440 -ip 4440
1⤵
PID:3532

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 136
  2⤵
  - Program crash
  PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5936 -ip 5936
1⤵
PID:852

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 288
  2⤵
  - Program crash
  PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5676 -ip 5676
1⤵
PID:1088

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 292
  2⤵
  - Program crash
  PID:6064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4460 -ip 4460
1⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 292
  2⤵
  - Program crash
  PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4668 -ip 4668
1⤵
PID:1952

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 288
  2⤵
  - Program crash
  PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3292 -ip 3292
1⤵
PID:5608

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4980

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 288
  2⤵
  - Program crash
  PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1476 -ip 1476
1⤵
PID:5452

C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe
"C:\Users\Admin\AppData\Local\Temp\SonicSAGE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 292
  2⤵
  - Program crash
  PID:5244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3608 -ip 3608
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4532 -ip 4532
1⤵
PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery