hxxps://drive[.]google[.]com/file/d/1a_15dCWTELrXLPCmkxVJ-z0WoaNhPHXq/view

Analysis

user interaction
yes
max time kernel
240s
max time network
242s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1a_15dCWTELrXLPCmkxVJ-z0WoaNhPHXq/view
Sample260714-dset9sft91

Score

8^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
84	5940	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
4888	7z2602.exe
2492	7zFM.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
3	drive.google.com
55	drive.google.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2924	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ug.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\readme.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\co.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ext.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\fr.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\io.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ro.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sa.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sv.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\zh-cn.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ba.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\da.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\en.ttt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\nl.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\pt-br.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\zh-cn.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7z.dll	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\be.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\id.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ne.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pl.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\si.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ast.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\bn.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fi.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ky.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\mn.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\nn.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ps.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\va.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\lv.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\da.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\fy.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ka.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ko.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\va.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\yo.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\zh-tw.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\id.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\io.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sr-spl.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\7z.dll	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\7z.exe	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7zCon.sfx	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Uninstall.exe	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\an.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ca.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\de.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ku.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ky.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sr-spc.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\7-zip.dll	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ca.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\fa.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\is.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\is.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\kab.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\mng.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ar.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\eo.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\eu.txt	7z2602.exe
File created	C:\Program Files (x86)\7-Zip\Lang\hr.txt	7z2602.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ku-ckb.txt	7z2602.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zFM.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5940	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284725827425560"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2602.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2602.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2602.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2602.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files (x86)\\7-Zip\\7-zip.dll"	7z2602.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2602.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2602.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2602.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
3796	chrome.exe
3796	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2492	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe
Token: SeShutdownPrivilege	1600	chrome.exe
Token: SeCreatePagefilePrivilege	1600	chrome.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe
1600	chrome.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3424	1600	chrome.exe	87
PID 1600 wrote to memory of 5940	1600	chrome.exe	88
PID 1600 wrote to memory of 3308	1600	chrome.exe	89
PID 1600 wrote to memory of 3308	1600	chrome.exe	89
PID 1600 wrote to memory of 5460	1600	chrome.exe	90
PID 1600 wrote to memory of 5460	1600	chrome.exe	90
PID 1600 wrote to memory of 1648	1600	chrome.exe	92
PID 1600 wrote to memory of 1648	1600	chrome.exe	92
PID 1600 wrote to memory of 1504	1600	chrome.exe	93
PID 1600 wrote to memory of 1504	1600	chrome.exe	93
PID 1600 wrote to memory of 2676	1600	chrome.exe	94
PID 1600 wrote to memory of 2676	1600	chrome.exe	94
PID 1600 wrote to memory of 2804	1600	chrome.exe	95
PID 1600 wrote to memory of 2804	1600	chrome.exe	95
PID 1600 wrote to memory of 5276	1600	chrome.exe	96
PID 1600 wrote to memory of 5724	1600	chrome.exe	98
PID 1600 wrote to memory of 5724	1600	chrome.exe	98
PID 1600 wrote to memory of 3608	1600	chrome.exe	99
PID 1600 wrote to memory of 3608	1600	chrome.exe	99
PID 1600 wrote to memory of 4004	1600	chrome.exe	100
PID 1600 wrote to memory of 4004	1600	chrome.exe	100
PID 1600 wrote to memory of 572	1600	chrome.exe	101
PID 1600 wrote to memory of 572	1600	chrome.exe	101
PID 1600 wrote to memory of 5812	1600	chrome.exe	104
PID 1600 wrote to memory of 5812	1600	chrome.exe	104
PID 1600 wrote to memory of 5592	1600	chrome.exe	105
PID 1600 wrote to memory of 5592	1600	chrome.exe	105
PID 1600 wrote to memory of 3936	1600	chrome.exe	106
PID 1600 wrote to memory of 3936	1600	chrome.exe	106
PID 1600 wrote to memory of 5652	1600	chrome.exe	107
PID 1600 wrote to memory of 5652	1600	chrome.exe	107
PID 1600 wrote to memory of 5644	1600	chrome.exe	108
PID 1600 wrote to memory of 5644	1600	chrome.exe	108
PID 1600 wrote to memory of 2564	1600	chrome.exe	110
PID 1600 wrote to memory of 4848	1600	chrome.exe	111
PID 1600 wrote to memory of 6092	1600	chrome.exe	112
PID 1600 wrote to memory of 724	1600	chrome.exe	113
PID 1600 wrote to memory of 4848	1600	chrome.exe	111
PID 1600 wrote to memory of 1812	1600	chrome.exe	114
PID 1600 wrote to memory of 1288	1600	chrome.exe	115
PID 1600 wrote to memory of 1288	1600	chrome.exe	115
PID 1600 wrote to memory of 5704	1600	chrome.exe	116
PID 1600 wrote to memory of 5704	1600	chrome.exe	116
PID 1600 wrote to memory of 928	1600	chrome.exe	117
PID 1600 wrote to memory of 928	1600	chrome.exe	117
PID 1600 wrote to memory of 4880	1600	chrome.exe	118
PID 1600 wrote to memory of 4880	1600	chrome.exe	118
PID 1600 wrote to memory of 1608	1600	chrome.exe	119
PID 1600 wrote to memory of 4888	1600	chrome.exe	120
PID 1600 wrote to memory of 3796	1600	chrome.exe	122
PID 1600 wrote to memory of 3148	1600	chrome.exe	124
PID 1600 wrote to memory of 3148	1600	chrome.exe	124
PID 5600 wrote to memory of 1832	5600	cmd.exe	127
PID 1832 wrote to memory of 5328	1832	cmd.exe	128
PID 1832 wrote to memory of 1900	1832	cmd.exe	129
PID 5600 wrote to memory of 6100	5600	cmd.exe	130
PID 5600 wrote to memory of 1912	5600	cmd.exe	131
PID 5600 wrote to memory of 1972	5600	cmd.exe	132
PID 5600 wrote to memory of 2924	5600	cmd.exe	133
PID 5600 wrote to memory of 5844	5600	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1a_15dCWTELrXLPCmkxVJ-z0WoaNhPHXq/view
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc3aa8c728,0x7ffc3aa8c734,0x7ffc3aa8c740
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,986674714332168054,4129668164626148054,524288 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,16581701133191229850,5953597381924513924,524288 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:13
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,5977330012112891708,6339243740459976041,262144 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,12392553178407610799,14349960256283558594,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,379419723709040647,1869373687269364034,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4992,i,245009662538732614,16135327050280337309,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5624,i,9440469537057225341,3755211563627671917,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,485985136405082751,249311076124044088,524288 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5848,i,7539088049494267337,13726680206324798255,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5888,i,4091251642125993054,2198655525308146145,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6296,i,6032694162543419903,5080414150549777650,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6184,i,7453019255388197883,1001769640221742602,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5940,i,9634358332020371303,15929577051673490398,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5924,i,1844620141058718004,2963455261061162227,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5968,i,12323822868377091795,13150588340571635985,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6788,i,14481550442508528806,6474685986836465629,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6592,i,14572160860999155168,17573359664519236691,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7120,i,13000450731690923504,9730158261751957893,524288 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6784,i,6164820798750779121,12896016445334113595,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,10055701716537169618,13034789767237765629,524288 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6928,i,17962323752870404482,8530206007390299735,524288 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,5173650149939091503,17727723445965785033,524288 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6340,i,2162362093692379250,11355795216597855783,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=792,i,5487084824868769072,16177791765688034255,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6628,i,5056836188129529611,13392773322482487341,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5640,i,1106381911015447497,3219576038413222095,2097152 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6976,i,18236976814136393042,9681389589266552621,524288 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:1608
- C:\Users\Admin\Downloads\7z2602.exe
  "C:\Users\Admin\Downloads\7z2602.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4780,i,5567495553502250611,11445137500806975453,262144 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4592,i,3138148119392995609,5903302529554006720,524288 --field-trial-handle=1920,i,7373186855158093344,14934303559954113158,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
  2⤵
  PID:3148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4396

C:\Program Files (x86)\7-Zip\7zFM.exe
"C:\Program Files (x86)\7-Zip\7zFM.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\KittyBot V1.2\KittyBot V1.2\KittyBot V1.2\KittyBot\Run.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir C:\ /s /b /a:d 2>nul | findstr /i /r /c:"\\KittyBot V1\.[0-9]$"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir C:\ /s /b /a:d 2>nul"
    3⤵
    PID:5328
- - C:\Windows\system32\findstr.exe
    findstr /i /r /c:"\\KittyBot V1\.[0-9]$"
    3⤵
    PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3.11 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  PID:6100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3.11 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  PID:1912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3.11 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  PID:1972
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq RocketLeague.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2924
- C:\Windows\system32\find.exe
  find /i "RocketLeague.exe"
  2⤵
  PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files (x86)\7-Zip\7zFM.exe
Size 605KB
SHA256 633702d7b9f3a936ef846cd49d5d1bc48c129b0da2c6349cf5df07bf539e6a46
MD5 c1b3126b8b785cd9797714423cd771c8
SHA1 b4c1c1779b617e454534003b171e9bf6bdf656d6
SHA512 f7783d06086cd8dbef8a814248752e85996790277533c213706b8c82fefc6800f89e69ae1ee766da13d4b46a5474403a7c79db6820f2bd6f8062432c2bb31e2b
SSDEEP 12288:/BrNUAfAyf/t4SzP9A5rfrG6YYDjxLQyex5dK/j:/pNhfLF4gGGnaLQymKb
TLSH
T1B8D44B163DFDC33BD3E19570CA6E7B94B0F9B9284E32885727801A2D1A75D81D317A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 a1d4506d31b1ca7292f8d6e60cda0265d27e28ec8a92b1460910d9b27e8d8e90
MD5 15419d89b118d4042bf3d9526a5abd2d
SHA1 964d5e601b782d78cb152fa7adecb43559e910ca
SHA512 74bb4bdc958b8f99ee2830a98709848aa2c34202c2d215c86789dd1f7bc06403daa0e3b87621bc6a9888b96f54c2b7eecb6f39da9afa6a90f6c603784b55f20a
TLSH
T163F06835B7B2F935DB604D7604622499F00420F7F1252E63CF8A27287C902E860B3393
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 5c499e0d52d070eea873c3b2b4473cbba633525426b35f994cc635c84ceedba0
MD5 5ee70ffb25d54a6780c41884da9a06e9
SHA1 a640370a30f336a3dd73aa4c6a2f87f020f5e9b3
SHA512 714858b1737a041609cbbc03646069bdb9bb804b29ea97aa4895eb4b3e2573c2579754de1bd77eb6079fc02eaf969f605d5d9f2cd763f95d93643ace76736128
SSDEEP 192:DcYWRxg39l0EZ2ZnpKT7BOVfYj3Z4i9Y5pIlaC01JJNPrA/aPifPFmwNmtL/X19:DcYWRxg39l0EZ2ZnpKT7BOVfYj3Z4i9Y
TLSH
T17222AAF7C3D9822DC91156F99B166F1ECE2E0A18432C3D26C8D8AF5B93E2871D21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 cd200f06637044a915a61cca26dca0c5543e26bdb2c09f618488fd704af8621c
MD5 c8483f926ec46c550ca4923ada1ef763
SHA1 199a711626656867ef42f29fea730ed61be05479
SHA512 5f3d045cc88b81268c5f35de13fb0125de47a0e717402160707c5501025958c64512af51aef66b66f1e6f06e8bb30bdb73669053333a46cd67f3a1cf6219e667
SSDEEP 192:DcYWRxg39l0EZ2ZnpKTCVfYj3744i9Y5pIlY2Cvn1rZo9:DcYWRxg39l0EZ2ZnpKTCVfYj3744i9Yq
TLSH
T1111289F7C3D9862DC95156F997126F1FCE2E0A1842283C26C8D8AF5F93E2932D21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 dc0c4c836186c6e6c4ffed1448abb293b4f70a6b5aef101744f770bc3ef43f3f
MD5 0edc5745efe301f3da1fc19c23a33967
SHA1 778ce48d83172dbf1441f355d9d85424513df86d
SHA512 6d830bbb2579066e78d99c836a2ca68c82314b6677b2d1e0a0e29aa27cc102ecf24dfec5ac60b9cffd91155a360751d29e25c425ed88ffb8dbeac8bc3527e04d
SSDEEP 192:5RR/Ao3v7JnvAPRp2hReW99Hsb+WNnCrsQH2M+We0+VyIsnAUgR:5RR/Pfd6XMvweX262R
TLSH
T16432962BAD1065375DDAC22AF9227BA7F3F5202575D42E84EBFC9A2C11E79CC2213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0376d2ddba2028b5be0b23f2840635a6bd19a3cccb03e081e2d6b496a0bfe625
MD5 bf8f30569083cd1f3436f3c809cf887f
SHA1 88d71724eb46b555b4151c1fb0e2d18b5eb221da
SHA512 c0fbb1cc070bcf3bdd132fe3aa9405492736e02a3a43dc65a11032fdb7fefc13997b1b444e4577478a348dcba49a4e5449051f0dcf820cb31560b59c3410e2a6
SSDEEP 192:8RNcBzzAo5v7Jk4PRpWhRnlX099Hsb+WNDf6JVQH+rY2MsRWeK+VyIsnAUgE:8RNmzzRZLXHvwc6x2g2E
TLSH
T11152B76FA92065375DDAD219F921BBABE3F5202571D42E84EBFC8A2C11E7ACC3113407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0941723a76936991bfe26cbf256c91ea7302506d240ffa3e634329aaaad9699d
MD5 1803cdbc3d90c3ab8bcac7be3e694824
SHA1 0834ccaf538f154fe03c981ed95ecf3c055f3508
SHA512 587ab0929a60403e1d12f5bf2439b1fb540c3dbbec9bd660f2043aebfea2973780f41ddc63c66afc55c6078c64de6f60e71920308d038a0e0a87b57acbd2fb40
SSDEEP 192:8RR/Ao5v7JkAPRp2hReW99Hsb+WNn6JVQH2MQWe++VyIsnAUgE:8RR/RZnXMvwo62k2E
TLSH
T10D42A66EAD10653B6DDAC219F9227BA7E3F5202571D42E84EBFC9A2C11E79CC3217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b7cce85549695522fe2fea281a8440b4d41057463126ee11054c9a044e74da6d
MD5 e4894e0c2651d59824ec5dd74db8f1bc
SHA1 b60b6e756576bce2c0e783ae0d6b5510e7768b52
SHA512 f07d9ff8f1e2588b4d90c923ea5607725f6d7d388cfeaff9228e8aa97763434b73a3d384e2f1a967ddccf806229424a3eab95de5f6171155b6fc0a5a3d43fdbf
SSDEEP 192:8RR/Aorv7JQAPRp2hReW99Hsb+WNn6JVQH2M8We0+VyIsnAUgR:8RR/PTPXMvwo62w2R
TLSH
T13032976BAD10653B5DDAC22AF9217BA7F3F5202571D42E84EBFC9A2C11E79CC2113407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 be362ab58947fdabe7e53da49488b11699e2f9d0f5d86e1c6680805211497bf7
MD5 6961d7b7a3fa075705cd26f29612d05a
SHA1 bde3d2b961ff72cd4885e5d24940ad036d16a504
SHA512 813f2b29a5e0fde33d3e1370754b44f7e9dd4e1ff8a180dbe4f62a458d3a27a3d2f02c19361287f033d66f3024d77ab8f731030653bacb78e3e6f00b4dae1694
SSDEEP 192:8RR/Ao2v7JQAPRp2hReW99Hsb+WNn6JVQH2MQWe++VyIsnAUgE:8RR/PCPXMvwo62k2E
TLSH
T12832A66EBD10653B6DDAC219F9227BA7E3F5202571D42E84EBFC9A2C11E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 54b0eea83d0e1a051b4f007a55427a1fed53e624e53da6a57c90836075dd8938
MD5 6560bcac7a7f731129acf32fe41d855d
SHA1 9d1985c5bc722cb20a3b650fcd14a3bf5a1fc2ee
SHA512 cea92d14cd933545a134829c02a2e092324d913b375cf11c0a2794447929eb8028c5fc6b6afb6699435fb0bace921eb275b7818e32d6c9823c0e30ecbb5072a0
SSDEEP 192:e/Q4K6I+7KxkXqK4I40pUZNCgVLHrKHfFKslE8nRXzKD/KB+ErUkKN9MFUxpElbC:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRu
TLSH
T1DF32C72BA48D9A3F4FA8D50DDC126F4BACA5025776780C2456FB9D0803A5BCE115A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 e77b19aad07fd69964e0e613191e4679f0f4b482842904986385937adb509b7f
MD5 260a1b56f2075e4bca6b9a92dfea605e
SHA1 7a3cbc93b23d87df23be2195cbf58a542baaa803
SHA512 860be0bec63c5e7815b6e796a8ebb108182845648ad4dbc59c38059997dee14b7a702d18c8d322fe1e6892e7e0da7422fa8fceaa98f7f9464161ea395f20674f
TLSH
T19DB02220E2830C02EA8B233302FA83C0F3308C2083030023A2C000CECE003C20AC3202
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 0078069a3bc9db97a51a064a380631850e3d41db22ba1384ac3a93f1c5a2fdd8
MD5 9b799f23edd024166b7c619e36c8d519
SHA1 d13ce480b1d3528a7198fe97c18dfc84c261b21d
SHA512 a06ed6e01e6550d12157a24002c526d6cfd4befa3cae25d8dbf9d3fa03b690ba9862945ac6a9a4a3ce1f601b2a735df4bc5816604293b76f95cd4a95d7a34533
SSDEEP 96:5bJ66yd+CgjAe56y7nKZwpOfsgaCSl8h4otop5+pPDiB6DGovk5EUwlvWkRNC39W:5tzyNgjf5ZKSNQiU2yijcUwlvWkuCm81
TLSH
T19AD119B1E82D5DA758F6D58971032E83DDA8205BA954BE58FDE85F0D00F75DD2383223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 e4a97b202eab91030153235ed9bcc8c9a0826f6622dc4cc3612ae989bd3feafd
MD5 bc3e1b4a23e766bf8a4d3aaa9d0f195e
SHA1 ae553f3aa4f2b0f86a3a25da1c204787e8705691
SHA512 03a893c41cf38dc2f07c9dfe8e49439156bbc12c99c89b1061c39d88642733fa65b42e952118d1e08f05ae079a79aa27d0d703800db3f14b951a53a7e9c6a633
SSDEEP 96:5C66Cd+CgjAe56y7nKZwpOfsgaCSl8h4otop5+pPDiB6DGovk5EMZH1Qzb/ZAWlD:5CzCNgjf5ZKSNQiU2yijcc2PKWlvW0Um
TLSH
T16BC10AB1A87D6E7365F6C189B1033A43DDF510AB5560EF94EAE94F0D00FB5AD2342222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9d1be3035823f00526729662cf3ffdfa403f23c227bb9ecc92ab7000311dbc40
MD5 cd5487ef1591b9cb7f7b8cee68b09e29
SHA1 3e2ba31bcd4ea9672806c9f3f4b04f117fb9e9d7
SHA512 9c7e65b4d96eee7e9d5ca5dbcbf863a55197a4e5236732fe17b74212d2cd241f7dbd265edead4ee41c434833fa5deecc784a9c479c5841aadf05ad6ed99796d4
SSDEEP 96:5C66Cd+CgjAe56y7nKZwpOfsobajcRDotok5+4DiB6vGyvk54EvWTboRYv4a:5CzCNgjf5ZKSNqDUDRi7qEvWTbog
TLSH
T1C9A119B1A4694EB394B6C58DB1427B43DEE421A7A561EF88E9DC5F0C00FB5E91342213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3467816bb3cc1a0c4a6afc6377661f9da503db8124133850902c7ae6d861e1bd
MD5 93a0401b1b45121852472e1b3e2a6a53
SHA1 ebd9c9f7f2cd4331bc07caaa6d14753d5ad09977
SHA512 b8030169f26ce579d164ed121d589d5da3312ac7f99af627b2c0e6bdccd21253473ac8d466fbd1eb98732447acac572e836c5a189369a5e2cf4835fec283cb54
SSDEEP 96:5C66Cd+CgjAe56y7nKZwpOfsgaCSl8h4otop5+hDiB67GGfvk5EMZH1Qzb/ZiWlD:5CzCNgjf5ZKSNQiU2ui6v3c2PkWlvW0x
TLSH
T14CC10AB1A87D6E7364F6C189B1033A43DDF520AB5560EB94EAE54F1D00FB5AD2342222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d102c79ad23893e3a5c9b309f7b62f3f8b8e0ecf0653c29ad23fb84273d561c3
MD5 c8850fb1fb165cf1b7fd129d78ff253c
SHA1 8e2dbc85bc8cbee314c1ad3ec19c72bcd1e9c793
SHA512 524b8054968a049c2b28650eec181f22f5eb67da4f3295b347d3c009708bc539c132ffbb1179bc4c02a6ea6bd2b45d8b50da8a3ee26d2331a1943e75d962e9b8
SSDEEP 96:5bJ66Cd+CgjAe56y7nKZwpOfsgaCSl8h4otop5+pPDiB6DGovk5EMZH1Qzb/Z/WF:5tzCNgjf5ZKSNQiU2yijcc2PRWlvW0Um
TLSH
T1CEC10AB1A87D6E7355F6D189B1033A43DDF510AB5560EF94EAE94F0D00FB5AD2342223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 a03f017602ce2fd64e9e418a80ae9d6879ef1f89b58b720528a540d9ad3c86f5
MD5 ffdf54eaea45a059d8f7d02a9d52e588
SHA1 6e324e52114ed897457a2b9354f8a41ccb8b6156
SHA512 6bf00e35adf3c1236051d7a0865bab16837b8f9f02db1cd2b9ed018bdfafce001ab10de75ab220307435901134e4218169521bdc3c8399e3f1d4631b75bedd59
SSDEEP 96:5bJ66Cd+CgjAe56y7nKZwpOfsgaCSl8h4otop5+pPDiB6DGovk5EUwlvWkRNC39W:5tzCNgjf5ZKSNQiU2yijcUwlvWkuCm81
TLSH
T174C109B1A82D5DA748F6D589B1032E83DDA8209B6664BE58F9E85F0D00F75DD2383223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 533525.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 533525.crdownload
Size 1.3MB
SHA256 17d894c17b04984b6ffcc1b31926b39c42d315cd861c3adbf7f34bd941d529ac
MD5 fa89dc6f1409a181e896daa5840756f1
SHA1 31bba021743eb5b872be8924cb67c428ed4ac861
SHA512 d8e34af2d4ade77ab6e88cc1e9dd4df88f788b7d9d747cd65955ab89f928030cfb61b1c20b9195cca47eba8a88364b5e6ec772de0080f2f27cb8a4570ea0f65c
SSDEEP 24576:P+Hx0990M0t4pwKQtSaxIzcck2tT1kEKd1crC2GXGTJH7zq81mDseT2rRtRyCR5i:Pcx0Yr+pwKQtSzhT1SDc7w6JbO8oYrRq
TLSH
T1885533B28260D3F9CBAF087075DFAC50D6769A809B8877A35F150A1DD334A4CC65A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download