36292969f0ed7d8a821006de3e995b68b8a7892b075ede7549267ade800afe45

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gsut-lab.lnk	python.exe

Executes dropped EXE 8 IoCs

pid	Process
4500	python.exe
2608	pythonw.exe
1192	python.exe
3124	python.exe
820	python.exe
1260	pythonw.exe
1324	python.exe
3620	python.exe

Loads dropped DLL 64 IoCs

pid	Process
4500	python.exe
4500	python.exe
4500	python.exe
4500	python.exe
4500	python.exe
4500	python.exe
4500	python.exe
4500	python.exe
4500	python.exe
4500	python.exe
4500	python.exe
2608	pythonw.exe
2608	pythonw.exe
2608	pythonw.exe
2608	pythonw.exe
2608	pythonw.exe
2608	pythonw.exe
2608	pythonw.exe
2608	pythonw.exe
2608	pythonw.exe
1192	python.exe
1192	python.exe
1192	python.exe
1192	python.exe
1192	python.exe
1192	python.exe
1192	python.exe
1192	python.exe
3124	python.exe
3124	python.exe
3124	python.exe
3124	python.exe
3124	python.exe
3124	python.exe
3124	python.exe
3124	python.exe
820	python.exe
820	python.exe
820	python.exe
820	python.exe
820	python.exe
820	python.exe
820	python.exe
820	python.exe
1260	pythonw.exe
1260	pythonw.exe
1324	python.exe
1324	python.exe
1260	pythonw.exe
1324	python.exe
1260	pythonw.exe
1324	python.exe
1260	pythonw.exe
1324	python.exe
1260	pythonw.exe
1324	python.exe
1260	pythonw.exe
1260	pythonw.exe
1324	python.exe
3620	python.exe
3620	python.exe
3620	python.exe
3620	python.exe
3620	python.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\gsut-lab = "\"C:\\Users\\Admin\\AppData\\Local\\gsut\\payload\\python-embed\\pythonw.exe\" \"C:\\Users\\Admin\\AppData\\Local\\gsut\\payload\\start.py\""	python.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
	\??\F:\	python.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFB461058B3292CD9D.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A9A3B38E-01F0-4CA0-823E-AF41644400AC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF96BA85282519271A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF16B.tmp	msiexec.exe
File created	C:\Windows\Installer\e59e6dc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e6dc.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e59e6e0.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE0CFD386484AAF05.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4C0E1189FAFDFE15.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	python.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pythonw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pythonw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4748	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	python.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	python.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	python.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	python.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	python.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	python.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	python.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	python.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	python.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	python.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	python.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	python.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	python.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	python.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3412	msiexec.exe
3412	msiexec.exe
1192	python.exe
1192	python.exe
5940	chrome.exe
5940	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1324	python.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe
5940	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5008	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5008	msiexec.exe
Token: SeSecurityPrivilege	3412	msiexec.exe
Token: SeCreateTokenPrivilege	5008	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5008	msiexec.exe
Token: SeLockMemoryPrivilege	5008	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5008	msiexec.exe
Token: SeMachineAccountPrivilege	5008	msiexec.exe
Token: SeTcbPrivilege	5008	msiexec.exe
Token: SeSecurityPrivilege	5008	msiexec.exe
Token: SeTakeOwnershipPrivilege	5008	msiexec.exe
Token: SeLoadDriverPrivilege	5008	msiexec.exe
Token: SeSystemProfilePrivilege	5008	msiexec.exe
Token: SeSystemtimePrivilege	5008	msiexec.exe
Token: SeProfSingleProcessPrivilege	5008	msiexec.exe
Token: SeIncBasePriorityPrivilege	5008	msiexec.exe
Token: SeCreatePagefilePrivilege	5008	msiexec.exe
Token: SeCreatePermanentPrivilege	5008	msiexec.exe
Token: SeBackupPrivilege	5008	msiexec.exe
Token: SeRestorePrivilege	5008	msiexec.exe
Token: SeShutdownPrivilege	5008	msiexec.exe
Token: SeDebugPrivilege	5008	msiexec.exe
Token: SeAuditPrivilege	5008	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5008	msiexec.exe
Token: SeChangeNotifyPrivilege	5008	msiexec.exe
Token: SeRemoteShutdownPrivilege	5008	msiexec.exe
Token: SeUndockPrivilege	5008	msiexec.exe
Token: SeSyncAgentPrivilege	5008	msiexec.exe
Token: SeEnableDelegationPrivilege	5008	msiexec.exe
Token: SeManageVolumePrivilege	5008	msiexec.exe
Token: SeImpersonatePrivilege	5008	msiexec.exe
Token: SeCreateGlobalPrivilege	5008	msiexec.exe
Token: SeBackupPrivilege	2808	vssvc.exe
Token: SeRestorePrivilege	2808	vssvc.exe
Token: SeAuditPrivilege	2808	vssvc.exe
Token: SeBackupPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5008	msiexec.exe
5008	msiexec.exe
5940	chrome.exe
5940	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5008	msiexec.exe
3412	msiexec.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 5008	3908	file.exe	88
PID 3412 wrote to memory of 1936	3412	msiexec.exe	94
PID 3412 wrote to memory of 4500	3412	msiexec.exe	96
PID 4500 wrote to memory of 2608	4500	python.exe	98
PID 2608 wrote to memory of 1192	2608	pythonw.exe	99
PID 2608 wrote to memory of 3124	2608	pythonw.exe	101
PID 2608 wrote to memory of 820	2608	pythonw.exe	103
PID 2608 wrote to memory of 1324	2608	pythonw.exe	108
PID 2608 wrote to memory of 3620	2608	pythonw.exe	110
PID 3620 wrote to memory of 5940	3620	python.exe	112
PID 3620 wrote to memory of 5940	3620	python.exe	112
PID 5940 wrote to memory of 4312	5940	chrome.exe	113
PID 5940 wrote to memory of 4748	5940	chrome.exe	114
PID 5940 wrote to memory of 3896	5940	chrome.exe	115
PID 5940 wrote to memory of 3896	5940	chrome.exe	115
PID 5940 wrote to memory of 3156	5940	chrome.exe	116
PID 5940 wrote to memory of 3156	5940	chrome.exe	116
PID 5940 wrote to memory of 5820	5940	chrome.exe	117
PID 5940 wrote to memory of 5820	5940	chrome.exe	117
PID 5940 wrote to memory of 5884	5940	chrome.exe	118
PID 5940 wrote to memory of 5884	5940	chrome.exe	118
PID 5940 wrote to memory of 4932	5940	chrome.exe	119
PID 5940 wrote to memory of 4932	5940	chrome.exe	119
PID 5940 wrote to memory of 2068	5940	chrome.exe	120
PID 5940 wrote to memory of 2068	5940	chrome.exe	120
PID 5940 wrote to memory of 708	5940	chrome.exe	121
PID 5940 wrote to memory of 708	5940	chrome.exe	121
PID 5940 wrote to memory of 3008	5940	chrome.exe	122
PID 5940 wrote to memory of 3008	5940	chrome.exe	122
PID 5940 wrote to memory of 3748	5940	chrome.exe	123
PID 5940 wrote to memory of 3748	5940	chrome.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\gsut-guest-setup.msi" /qb MSIINSTALLPERUSER=1 /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5008

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1936
- C:\Users\Admin\AppData\Local\gsut\guest\python-embed\python.exe
  "C:\Users\Admin\AppData\Local\gsut\guest\python-embed\python.exe" -B "C:\Users\Admin\AppData\Local\gsut\guest\bootstrap.py"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Users\Admin\AppData\Local\gsut\payload\python-embed\pythonw.exe
    C:\Users\Admin\AppData\Local\gsut\payload\python-embed\pythonw.exe -B C:\Users\Admin\AppData\Local\gsut\payload\start.py
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\AppData\Local\gsut\payload\python-embed\python.exe
      "C:\Users\Admin\AppData\Local\gsut\payload\python-embed\python.exe" -B "C:\Users\Admin\AppData\Local\gsut\payload\plugin_host.py" --id probe --config C:\Users\Admin\AppData\Local\gsut\payload\guest.json
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:1192
  - - C:\Users\Admin\AppData\Local\gsut\payload\python-embed\python.exe
      "C:\Users\Admin\AppData\Local\gsut\payload\python-embed\python.exe" -B "C:\Users\Admin\AppData\Local\gsut\payload\plugin_host.py" --root "C:\Users\Admin\AppData\Local\gsut\payload" --policy run_lnk --config C:\Users\Admin\AppData\Local\gsut\payload\guest.json
      4⤵
      Creates a file in the Startup directory
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      PID:3124
  - - C:\Users\Admin\AppData\Local\gsut\payload\python-embed\python.exe
      "C:\Users\Admin\AppData\Local\gsut\payload\python-embed\python.exe" -B "C:\Users\Admin\AppData\Local\gsut\payload\plugin_host.py" --root "C:\Users\Admin\AppData\Local\gsut\payload" --policy run_lnk --config C:\Users\Admin\AppData\Local\gsut\payload\guest.json
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:820
  - - C:\Users\Admin\AppData\Local\gsut\payload\python-embed\python.exe
      "C:\Users\Admin\AppData\Local\gsut\payload\python-embed\python.exe" -B "C:\Users\Admin\AppData\Local\gsut\payload\plugin_host.py" --id remote --config C:\Users\Admin\AppData\Local\gsut\payload\guest.json
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates system info in registry
      Suspicious behavior: GetForegroundWindowSpam
      PID:1324
  - - C:\Users\Admin\AppData\Local\gsut\payload\python-embed\python.exe
      "C:\Users\Admin\AppData\Local\gsut\payload\python-embed\python.exe" -B "C:\Users\Admin\AppData\Local\gsut\payload\plugin_host.py" --id es-browser-creds --probe-id e79e057631cd8521728a22ebe3b7eaad --config C:\Users\Admin\AppData\Local\gsut\payload\guest.json
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3620
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile" --no-first-run --no-default-browser-check
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5940
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffac17ec728,0x7ffac17ec734,0x7ffac17ec740
        6⤵
        
        PID:4312
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1800,i,14559979442372970632,16044859591260489755,524288 --field-trial-handle=2264,i,827555839258011190,10608361102225539936,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:4748
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,7337032196523517878,6854213810159122235,262144 --field-trial-handle=2264,i,827555839258011190,10608361102225539936,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
        6⤵
        
        PID:3896
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile" --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,2963893828595222884,5808489362725614390,524288 --field-trial-handle=2264,i,827555839258011190,10608361102225539936,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
        6⤵
        
        PID:3156
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,13029709070250759323,8110947870859203423,2097152 --field-trial-handle=2264,i,827555839258011190,10608361102225539936,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
        6⤵
        
        PID:5820
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,9915748035580739630,14472363470511061227,2097152 --field-trial-handle=2264,i,827555839258011190,10608361102225539936,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
        6⤵
        
        PID:5884
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3688,i,8040926797036129711,14840218375100421791,2097152 --field-trial-handle=2264,i,827555839258011190,10608361102225539936,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:9
        6⤵
        
        PID:4932
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3656,i,3471285803540000736,7648997099295305456,2097152 --field-trial-handle=2264,i,827555839258011190,10608361102225539936,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
        6⤵
        
        PID:2068
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4664,i,17560016025736085401,5747602985387470565,2097152 --field-trial-handle=2264,i,827555839258011190,10608361102225539936,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
        6⤵
        
        PID:708
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5084,i,11265405375227809942,18262316369774743228,2097152 --field-trial-handle=2264,i,827555839258011190,10608361102225539936,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:9
        6⤵
        
        PID:3008
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gsu17A0.tmp\abe_profile" --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,6171011609770487313,5922064315642566800,524288 --field-trial-handle=2264,i,827555839258011190,10608361102225539936,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
        6⤵
        
        PID:3748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Users\Admin\AppData\Local\gsut\payload\python-embed\pythonw.exe
"C:\Users\Admin\AppData\Local\gsut\payload\python-embed\pythonw.exe" "C:\Users\Admin\AppData\Local\gsut\payload\start.py"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery