valleyrat_s2 | a92ecd1a211c7114b9309c6706189edcbcf982a261a66d8960befa1fbb73e9b4

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	men.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	men.exe

Executes dropped EXE 9 IoCs

pid	Process
4784	Chorme_setupX64_v1.9.06.tmp
5544	Aunar.exe
5164	setup.exe
6004	men.exe
2672	StartMenuExperienceHostker.exe
2716	WUDFCompanionHoste.exe
2760	setup.exe
1884	setup.exe
5528	StartMenuExperienceHostker.exe

Loads dropped DLL 2 IoCs

pid	Process
5544	Aunar.exe
2716	WUDFCompanionHoste.exe

Modifies file permissions 1 TTPs 4 IoCs

File and Directory Permissions Modification

T1222

pid	Process
636	takeown.exe
3780	icacls.exe
1368	takeown.exe
1452	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5372	powershell.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\I:	WUDFCompanionHoste.exe
File opened (read-only)	\??\K:	WUDFCompanionHoste.exe
File opened (read-only)	\??\L:	WUDFCompanionHoste.exe
File opened (read-only)	\??\O:	WUDFCompanionHoste.exe
File opened (read-only)	\??\R:	WUDFCompanionHoste.exe
File opened (read-only)	\??\U:	WUDFCompanionHoste.exe
File opened (read-only)	\??\V:	WUDFCompanionHoste.exe
File opened (read-only)	\??\D:	WUDFCompanionHoste.exe
File opened (read-only)	\??\M:	WUDFCompanionHoste.exe
File opened (read-only)	\??\P:	WUDFCompanionHoste.exe
File opened (read-only)	\??\S:	WUDFCompanionHoste.exe
File opened (read-only)	\??\T:	WUDFCompanionHoste.exe
File opened (read-only)	\??\W:	WUDFCompanionHoste.exe
File opened (read-only)	\??\Z:	WUDFCompanionHoste.exe
File opened (read-only)	\??\B:	WUDFCompanionHoste.exe
File opened (read-only)	\??\G:	WUDFCompanionHoste.exe
File opened (read-only)	\??\Y:	WUDFCompanionHoste.exe
File opened (read-only)	\??\J:	WUDFCompanionHoste.exe
File opened (read-only)	\??\N:	WUDFCompanionHoste.exe
File opened (read-only)	\??\Q:	WUDFCompanionHoste.exe
File opened (read-only)	\??\X:	WUDFCompanionHoste.exe
File opened (read-only)	\??\H:	WUDFCompanionHoste.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aunar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartMenuExperienceHostker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFCompanionHoste.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chorme_setupX64_v1.9.06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chorme_setupX64_v1.9.06.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
1256	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
216	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4712-0-0x0000000000470000-0x000000000054C000-memory.dmp	innosetup
behavioral2/memory/4712-75-0x0000000000470000-0x000000000054C000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2688	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134130073854384364"	chrome.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3099004632-2081848121-963186171-1000_Classes\49181364e441aad9b340956ed153b8e5\0	WUDFCompanionHoste.exe
Key created	\REGISTRY\USER\S-1-5-21-3099004632-2081848121-963186171-1000_Classes\49181364e441aad9b340956ed153b8e5\1	WUDFCompanionHoste.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3099004632-2081848121-963186171-1000_Classes\49181364e441aad9b340956ed153b8e5\i = "1768533786"	WUDFCompanionHoste.exe
Key created	\REGISTRY\USER\S-1-5-21-3099004632-2081848121-963186171-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3099004632-2081848121-963186171-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3099004632-2081848121-963186171-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3099004632-2081848121-963186171-1000\{165FC886-2792-4FD5-A152-5C22FEF42A3D}	WUDFCompanionHoste.exe
Key created	\REGISTRY\USER\S-1-5-21-3099004632-2081848121-963186171-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3099004632-2081848121-963186171-1000_Classes\49181364e441aad9b340956ed153b8e5	WUDFCompanionHoste.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1256	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4784	Chorme_setupX64_v1.9.06.tmp
4784	Chorme_setupX64_v1.9.06.tmp
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
6004	men.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe
2672	StartMenuExperienceHostker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	WUDFCompanionHoste.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5724	chrome.exe
5724	chrome.exe
5724	chrome.exe
5724	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	5164	setup.exe
Token: SeIncBasePriorityPrivilege	5164	setup.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeShutdownPrivilege	5724	chrome.exe
Token: SeCreatePagefilePrivilege	5724	chrome.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeTakeOwnershipPrivilege	636	takeown.exe
Token: SeDebugPrivilege	5372	powershell.exe
Token: SeShutdownPrivilege	5724	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4784	Chorme_setupX64_v1.9.06.tmp
5724	chrome.exe
5724	chrome.exe
5724	chrome.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4784	4712	Chorme_setupX64_v1.9.06.exe	82
PID 4784 wrote to memory of 1824	4784	Chorme_setupX64_v1.9.06.tmp	84
PID 1824 wrote to memory of 5544	1824	cmd.exe	86
PID 4784 wrote to memory of 5164	4784	Chorme_setupX64_v1.9.06.tmp	90
PID 4784 wrote to memory of 6004	4784	Chorme_setupX64_v1.9.06.tmp	91
PID 6004 wrote to memory of 2672	6004	men.exe	92
PID 2672 wrote to memory of 2716	2672	StartMenuExperienceHostker.exe	93
PID 5164 wrote to memory of 2760	5164	setup.exe	95
PID 2760 wrote to memory of 1884	2760	setup.exe	96
PID 2760 wrote to memory of 5724	2760	setup.exe	97
PID 5724 wrote to memory of 1544	5724	chrome.exe	98
PID 5724 wrote to memory of 216	5724	chrome.exe	100
PID 5724 wrote to memory of 1916	5724	chrome.exe	101
PID 5724 wrote to memory of 1916	5724	chrome.exe	101
PID 5724 wrote to memory of 5944	5724	chrome.exe	102
PID 5724 wrote to memory of 5944	5724	chrome.exe	102
PID 5724 wrote to memory of 5540	5724	chrome.exe	103
PID 5724 wrote to memory of 5540	5724	chrome.exe	103
PID 5724 wrote to memory of 352	5724	chrome.exe	104
PID 5724 wrote to memory of 352	5724	chrome.exe	104
PID 5724 wrote to memory of 2868	5724	chrome.exe	105
PID 5724 wrote to memory of 2868	5724	chrome.exe	105
PID 5724 wrote to memory of 2424	5724	chrome.exe	106
PID 5724 wrote to memory of 2424	5724	chrome.exe	106
PID 5724 wrote to memory of 2328	5724	chrome.exe	109
PID 5724 wrote to memory of 4412	5724	chrome.exe	110
PID 4412 wrote to memory of 4308	4412	chrmstp.exe	112
PID 4412 wrote to memory of 2264	4412	chrmstp.exe	113
PID 2264 wrote to memory of 1316	2264	chrmstp.exe	114
PID 6004 wrote to memory of 2688	6004	men.exe	118
PID 6004 wrote to memory of 1272	6004	men.exe	120
PID 6004 wrote to memory of 784	6004	men.exe	121
PID 1272 wrote to memory of 636	1272	cmd.exe	124
PID 784 wrote to memory of 1256	784	cmd.exe	125
PID 1272 wrote to memory of 3780	1272	cmd.exe	126
PID 1272 wrote to memory of 1368	1272	cmd.exe	127
PID 1272 wrote to memory of 1452	1272	cmd.exe	128
PID 1272 wrote to memory of 5372	1272	cmd.exe	129
PID 5724 wrote to memory of 5208	5724	chrome.exe	131
PID 5724 wrote to memory of 1436	5724	chrome.exe	132
PID 5724 wrote to memory of 3712	5724	chrome.exe	133
PID 5724 wrote to memory of 4400	5724	chrome.exe	135
PID 5724 wrote to memory of 6088	5724	chrome.exe	136
PID 5724 wrote to memory of 6088	5724	chrome.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Chorme_setupX64_v1.9.06.exe
"C:\Users\Admin\AppData\Local\Temp\Chorme_setupX64_v1.9.06.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\is-IHM3E.tmp\Chorme_setupX64_v1.9.06.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IHM3E.tmp\Chorme_setupX64_v1.9.06.tmp" /SL5="$501B4,113857907,845824,C:\Users\Admin\AppData\Local\Temp\Chorme_setupX64_v1.9.06.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C C:\Users\Public\Documents\Aunar.exe -password "htLcENyRFYwXsHFnUnqK" -no-directory -force-overwrite -output-directory "C:\Users\Public\Documents" "C:\Users\Public\Documents\mainZTtRjTfyhNIDCAF.xml" >nul 2>&1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Users\Public\Documents\Aunar.exe
      C:\Users\Public\Documents\Aunar.exe -password "htLcENyRFYwXsHFnUnqK" -no-directory -force-overwrite -output-directory "C:\Users\Public\Documents" "C:\Users\Public\Documents\mainZTtRjTfyhNIDCAF.xml"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5544
- - C:\Users\Public\Documents\setup.exe
    "C:\Users\Public\Documents\setup.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Users\Public\Documents\CR_BF71A.tmp\setup.exe
      "C:\Users\Public\Documents\CR_BF71A.tmp\setup.exe" --install-archive="C:\Users\Public\Documents\CR_BF71A.tmp\CHROME.PACKED.7Z"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Users\Public\Documents\CR_BF71A.tmp\setup.exe
        
        C:\Users\Public\Documents\CR_BF71A.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=91.0.4472.124 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2a8,0x2d8,0x7ff6460def20,0x7ff6460def30,0x7ff6460def40
        5⤵
        Executes dropped EXE
        
        PID:1884
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
        5⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5724
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x40,0x228,0x7ffe8498c728,0x7ffe8498c734,0x7ffe8498c740
        6⤵
        
        PID:1544
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1640,i,11569019434810792773,13959000006438176351,524288 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2128 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:216
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,12814157221568211170,5376393600784675696,262144 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2088 /prefetch:2
        6⤵
        
        PID:1916
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,6456609945063554342,12049637531413646585,524288 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2524 /prefetch:8
        6⤵
        
        PID:5944
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,9511534701244460937,16759299143831904014,2097152 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3232 /prefetch:1
        6⤵
        
        PID:5540
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,18091795132705435617,5276821087202190321,2097152 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3256 /prefetch:1
        6⤵
        
        PID:352
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,3630813605929629995,3153001475389634507,2097152 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4304 /prefetch:2
        6⤵
        
        PID:2868
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,15690284018543840390,12783197012552982077,2097152 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4708 /prefetch:1
        6⤵
        
        PID:2424
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,5345813159958143440,352527727340112673,524288 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5408 /prefetch:8
        6⤵
        
        PID:2328
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
        6⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2a8,0x2ac,0x2b0,0x284,0x2b4,0x7ff7e34055a0,0x7ff7e34055ac,0x7ff7e34055b8
        7⤵
        Drops file in Windows directory
        
        PID:4308
        
        C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        7⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff7e34055a0,0x7ff7e34055ac,0x7ff7e34055b8
        8⤵
        Drops file in Windows directory
        
        PID:1316
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,3607802725145525532,8999339387881613854,524288 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5712 /prefetch:8
        6⤵
        
        PID:5208
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,1469454355212801079,15439702749566980084,524288 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5724 /prefetch:8
        6⤵
        
        PID:1436
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,11069100448788547273,1439650190060259735,524288 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5420 /prefetch:8
        6⤵
        
        PID:3712
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=840,i,15673557179726246946,8524809448887704102,262144 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5136 /prefetch:8
        6⤵
        
        PID:4400
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3060,i,4313600249562335270,5611454409052553735,524288 --field-trial-handle=2092,i,8371315594555909634,8831809762624170417,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5656 /prefetch:8
        6⤵
        
        PID:6088
- - C:\Users\Public\Documents\men.exe
    "C:\Users\Public\Documents\men.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exe
      C:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Users\Public\Documents\x86-Microsoft-Windowsdata\WUDFCompanionHoste.exe
        
        C:\Users\Public\Documents\x86-Microsoft-Windowsdata\WUDFCompanionHoste.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:2716
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM KANG.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2688
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "takeown /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /a >nul 2>&1 & icacls "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F >nul 2>&1 & takeown /f "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F >nul 2>&1 & icacls "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /deny Everyone:D >nul 2>&1 & powershell -Command \"$regPath = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData'; $acl = (Get-Item -Path $regPath).GetAccessControl(); $acl.SetAccessRuleProtection($true); $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_); }; $sidSystem = New-Object System.Security.Principal.Security.Identity('S-1-5-18'); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidSystem,'FullControl','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidAdmins,'ReadKey','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidEveryone,'Delete','Deny'))); (Get-Item -Path $regPath).SetAccessControl($acl); Disable-ScheduledTask -TaskName 'WindowsPowerShell.WbemScripting.WindowsData'; Write-Host 'X' -ForegroundColor Green;\""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /a
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:636
    - - C:\Windows\system32\icacls.exe
        
        icacls "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3780
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1368
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /deny Everyone:D
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command \"$regPath = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData'; $acl = (Get-Item -Path $regPath).GetAccessControl(); $acl.SetAccessRuleProtection($true); $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_); }; $sidSystem = New-Object System.Security.Principal.Security.Identity('S-1-5-18'); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidSystem,'FullControl','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidAdmins,'ReadKey','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidEveryone,'Delete','Deny'))); (Get-Item -Path $regPath).SetAccessControl($acl); Disable-ScheduledTask -TaskName 'WindowsPowerShell.WbemScripting.WindowsData'; Write-Host 'X' -ForegroundColor Green;\"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c del.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:784
    - - C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4008

C:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exe
C:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exe
1⤵
- Executes dropped EXE
PID:5528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery