valleyrat_s2 | a92ecd1a211c7114b9309c6706189edcbcf982a261a66d8960befa1fbb73e9b4

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	men.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	men.exe

Executes dropped EXE 9 IoCs

pid	Process
4808	Chorme_setupX64_v1.9.06.tmp
4900	Aunar.exe
5756	setup.exe
4240	men.exe
1556	StartMenuExperienceHostker.exe
3208	WUDFCompanionHoste.exe
2952	setup.exe
4976	setup.exe
2744	StartMenuExperienceHostker.exe

Loads dropped DLL 2 IoCs

pid	Process
4900	Aunar.exe
3208	WUDFCompanionHoste.exe

Modifies file permissions 1 TTPs 4 IoCs

File and Directory Permissions Modification

T1222

pid	Process
2100	icacls.exe
5600	takeown.exe
5192	icacls.exe
2268	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3012	powershell.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\R:	WUDFCompanionHoste.exe
File opened (read-only)	\??\K:	WUDFCompanionHoste.exe
File opened (read-only)	\??\N:	WUDFCompanionHoste.exe
File opened (read-only)	\??\S:	WUDFCompanionHoste.exe
File opened (read-only)	\??\U:	WUDFCompanionHoste.exe
File opened (read-only)	\??\W:	WUDFCompanionHoste.exe
File opened (read-only)	\??\H:	WUDFCompanionHoste.exe
File opened (read-only)	\??\J:	WUDFCompanionHoste.exe
File opened (read-only)	\??\O:	WUDFCompanionHoste.exe
File opened (read-only)	\??\T:	WUDFCompanionHoste.exe
File opened (read-only)	\??\V:	WUDFCompanionHoste.exe
File opened (read-only)	\??\B:	WUDFCompanionHoste.exe
File opened (read-only)	\??\E:	WUDFCompanionHoste.exe
File opened (read-only)	\??\I:	WUDFCompanionHoste.exe
File opened (read-only)	\??\L:	WUDFCompanionHoste.exe
File opened (read-only)	\??\M:	WUDFCompanionHoste.exe
File opened (read-only)	\??\Q:	WUDFCompanionHoste.exe
File opened (read-only)	\??\X:	WUDFCompanionHoste.exe
File opened (read-only)	\??\Y:	WUDFCompanionHoste.exe
File opened (read-only)	\??\G:	WUDFCompanionHoste.exe
File opened (read-only)	\??\P:	WUDFCompanionHoste.exe
File opened (read-only)	\??\Z:	WUDFCompanionHoste.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chorme_setupX64_v1.9.06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chorme_setupX64_v1.9.06.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aunar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartMenuExperienceHostker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFCompanionHoste.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
5208	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
5384	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral3/memory/4800-1-0x0000000000570000-0x000000000064C000-memory.dmp	innosetup
behavioral3/memory/4800-55-0x0000000000570000-0x000000000064C000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
432	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134130073831203154"	chrome.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000_Classes\49181364e441aad9b340956ed153b8e5\0	WUDFCompanionHoste.exe
Key created	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000_Classes\49181364e441aad9b340956ed153b8e5\1	WUDFCompanionHoste.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000_Classes\49181364e441aad9b340956ed153b8e5\i = "1768533784"	WUDFCompanionHoste.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4220518935-1083122485-1008052776-1000\{E5EEF921-6206-4857-BE79-B3CC2E5041A2}	WUDFCompanionHoste.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000_Classes\49181364e441aad9b340956ed153b8e5	WUDFCompanionHoste.exe
Key created	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5208	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4808	Chorme_setupX64_v1.9.06.tmp
4808	Chorme_setupX64_v1.9.06.tmp
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
4240	men.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe
1556	StartMenuExperienceHostker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3208	WUDFCompanionHoste.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	5756	setup.exe
Token: SeIncBasePriorityPrivilege	5756	setup.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeShutdownPrivilege	5100	chrome.exe
Token: SeCreatePagefilePrivilege	5100	chrome.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeTakeOwnershipPrivilege	5600	takeown.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeShutdownPrivilege	5100	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4808	Chorme_setupX64_v1.9.06.tmp
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
3768	chrmstp.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4808	4800	Chorme_setupX64_v1.9.06.exe	77
PID 4808 wrote to memory of 1444	4808	Chorme_setupX64_v1.9.06.tmp	79
PID 1444 wrote to memory of 4900	1444	cmd.exe	81
PID 4808 wrote to memory of 5756	4808	Chorme_setupX64_v1.9.06.tmp	82
PID 4808 wrote to memory of 4240	4808	Chorme_setupX64_v1.9.06.tmp	83
PID 4240 wrote to memory of 1556	4240	men.exe	84
PID 1556 wrote to memory of 3208	1556	StartMenuExperienceHostker.exe	85
PID 5756 wrote to memory of 2952	5756	setup.exe	86
PID 2952 wrote to memory of 4976	2952	setup.exe	87
PID 2952 wrote to memory of 5100	2952	setup.exe	88
PID 5100 wrote to memory of 5588	5100	chrome.exe	89
PID 5100 wrote to memory of 3372	5100	chrome.exe	91
PID 5100 wrote to memory of 3372	5100	chrome.exe	91
PID 5100 wrote to memory of 5384	5100	chrome.exe	92
PID 5100 wrote to memory of 688	5100	chrome.exe	93
PID 5100 wrote to memory of 688	5100	chrome.exe	93
PID 5100 wrote to memory of 1296	5100	chrome.exe	94
PID 5100 wrote to memory of 3140	5100	chrome.exe	95
PID 5100 wrote to memory of 1296	5100	chrome.exe	94
PID 5100 wrote to memory of 3140	5100	chrome.exe	95
PID 5100 wrote to memory of 3788	5100	chrome.exe	97
PID 5100 wrote to memory of 3788	5100	chrome.exe	97
PID 5100 wrote to memory of 1816	5100	chrome.exe	98
PID 5100 wrote to memory of 1816	5100	chrome.exe	98
PID 5100 wrote to memory of 2080	5100	chrome.exe	100
PID 5100 wrote to memory of 424	5100	chrome.exe	101
PID 424 wrote to memory of 3504	424	chrmstp.exe	103
PID 424 wrote to memory of 3768	424	chrmstp.exe	104
PID 3768 wrote to memory of 3344	3768	chrmstp.exe	105
PID 4240 wrote to memory of 432	4240	men.exe	106
PID 4240 wrote to memory of 2028	4240	men.exe	108
PID 4240 wrote to memory of 3964	4240	men.exe	109
PID 3964 wrote to memory of 5208	3964	cmd.exe	112
PID 2028 wrote to memory of 5600	2028	cmd.exe	113
PID 2028 wrote to memory of 5192	2028	cmd.exe	114
PID 2028 wrote to memory of 2268	2028	cmd.exe	115
PID 2028 wrote to memory of 2100	2028	cmd.exe	116
PID 2028 wrote to memory of 3012	2028	cmd.exe	117
PID 5100 wrote to memory of 2304	5100	chrome.exe	118
PID 5100 wrote to memory of 4724	5100	chrome.exe	119
PID 5100 wrote to memory of 644	5100	chrome.exe	120
PID 5100 wrote to memory of 4544	5100	chrome.exe	123
PID 5100 wrote to memory of 2692	5100	chrome.exe	124
PID 5100 wrote to memory of 2692	5100	chrome.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Chorme_setupX64_v1.9.06.exe
"C:\Users\Admin\AppData\Local\Temp\Chorme_setupX64_v1.9.06.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\is-LS4GF.tmp\Chorme_setupX64_v1.9.06.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LS4GF.tmp\Chorme_setupX64_v1.9.06.tmp" /SL5="$5006E,113857907,845824,C:\Users\Admin\AppData\Local\Temp\Chorme_setupX64_v1.9.06.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C C:\Users\Public\Documents\Aunar.exe -password "htLcENyRFYwXsHFnUnqK" -no-directory -force-overwrite -output-directory "C:\Users\Public\Documents" "C:\Users\Public\Documents\mainZTtRjTfyhNIDCAF.xml" >nul 2>&1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Users\Public\Documents\Aunar.exe
      C:\Users\Public\Documents\Aunar.exe -password "htLcENyRFYwXsHFnUnqK" -no-directory -force-overwrite -output-directory "C:\Users\Public\Documents" "C:\Users\Public\Documents\mainZTtRjTfyhNIDCAF.xml"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4900
- - C:\Users\Public\Documents\setup.exe
    "C:\Users\Public\Documents\setup.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Users\Public\Documents\CR_02FD6.tmp\setup.exe
      "C:\Users\Public\Documents\CR_02FD6.tmp\setup.exe" --install-archive="C:\Users\Public\Documents\CR_02FD6.tmp\CHROME.PACKED.7Z"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\Users\Public\Documents\CR_02FD6.tmp\setup.exe
        
        C:\Users\Public\Documents\CR_02FD6.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=91.0.4472.124 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff61390ef20,0x7ff61390ef30,0x7ff61390ef40
        5⤵
        Executes dropped EXE
        
        PID:4976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5100
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86241c728,0x7ff86241c734,0x7ff86241c740
        6⤵
        
        PID:5588
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,2098917719366435727,2524989716194801664,262144 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=1976 /prefetch:2
        6⤵
        
        PID:3372
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,7174829995404592427,13142886179412239523,524288 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2288 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:5384
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=216,i,11123665434985977053,17069947996679672187,524288 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=2460 /prefetch:13
        6⤵
        
        PID:688
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,3596351038066916917,5401606776163850750,2097152 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3204 /prefetch:1
        6⤵
        
        PID:1296
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,3127874085195290988,674340319875834688,2097152 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=3224 /prefetch:1
        6⤵
        
        PID:3140
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4328,i,4498895767335014034,10311039236549538169,2097152 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4352 /prefetch:9
        6⤵
        
        PID:3788
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4604,i,6160013326529390199,6861640682098090260,2097152 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4616 /prefetch:1
        6⤵
        
        PID:1816
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,9953792799430091075,15884049411205109343,524288 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5416 /prefetch:14
        6⤵
        
        PID:2080
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
        6⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:424
        
        C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff67a4855a0,0x7ff67a4855ac,0x7ff67a4855b8
        7⤵
        Drops file in Windows directory
        
        PID:3504
        
        C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        7⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff67a4855a0,0x7ff67a4855ac,0x7ff67a4855b8
        8⤵
        Drops file in Windows directory
        
        PID:3344
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,12932266502618972243,4782509275845128523,524288 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5868 /prefetch:14
        6⤵
        
        PID:2304
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,8754126236716325177,7151114893716396033,524288 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5912 /prefetch:14
        6⤵
        
        PID:4724
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,6036737172565735912,7307643624118289209,524288 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5952 /prefetch:14
        6⤵
        
        PID:644
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5932,i,1636986915837398899,7122486211730684546,262144 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=5920 /prefetch:10
        6⤵
        
        PID:4544
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,14882601726035135507,3318380052118774002,524288 --field-trial-handle=1988,i,14543231921490890231,2856828535971427153,262144 --variations-seed-version=20251219-070015.367000 --mojo-platform-channel-handle=4536 /prefetch:14
        6⤵
        
        PID:2692
- - C:\Users\Public\Documents\men.exe
    "C:\Users\Public\Documents\men.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exe
      C:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Users\Public\Documents\x86-Microsoft-Windowsdata\WUDFCompanionHoste.exe
        
        C:\Users\Public\Documents\x86-Microsoft-Windowsdata\WUDFCompanionHoste.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:3208
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM KANG.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:432
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c "takeown /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /a >nul 2>&1 & icacls "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F >nul 2>&1 & takeown /f "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F >nul 2>&1 & icacls "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /deny Everyone:D >nul 2>&1 & powershell -Command \"$regPath = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData'; $acl = (Get-Item -Path $regPath).GetAccessControl(); $acl.SetAccessRuleProtection($true); $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_); }; $sidSystem = New-Object System.Security.Principal.Security.Identity('S-1-5-18'); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidSystem,'FullControl','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidAdmins,'ReadKey','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidEveryone,'Delete','Deny'))); (Get-Item -Path $regPath).SetAccessControl($acl); Disable-ScheduledTask -TaskName 'WindowsPowerShell.WbemScripting.WindowsData'; Write-Host 'X' -ForegroundColor Green;\""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2028
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /a
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:5600
    - - C:\Windows\system32\icacls.exe
        
        icacls "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5192
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2268
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /deny Everyone:D
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command \"$regPath = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData'; $acl = (Get-Item -Path $regPath).GetAccessControl(); $acl.SetAccessRuleProtection($true); $acl.Access | ForEach-Object { $acl.RemoveAccessRule($_); }; $sidSystem = New-Object System.Security.Principal.Security.Identity('S-1-5-18'); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidSystem,'FullControl','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidAdmins,'ReadKey','Allow'))); $acl.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($sidEveryone,'Delete','Deny'))); (Get-Item -Path $regPath).SetAccessControl($acl); Disable-ScheduledTask -TaskName 'WindowsPowerShell.WbemScripting.WindowsData'; Write-Host 'X' -ForegroundColor Green;\"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c del.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2232

C:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exe
C:\Users\Public\Documents\x86-Microsoft-Windowsdata\StartMenuExperienceHostker.exe
1⤵
- Executes dropped EXE
PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery