42f8d650982905a593335f6d57d452240d1400539d0fb8e863d0ccf1382dbd02

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	X86 Token Finder.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	X86 Token Finder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	X86 Token Finder.exe

Executes dropped EXE 3 IoCs

pid	Process
5816	token finder.exe
4580	DirectX setup.exe
5812	DirectX setup.exe

Loads dropped DLL 17 IoCs

pid	Process
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe
5812	DirectX setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/5384-0-0x0000000000400000-0x0000000001232000-memory.dmp	themida
behavioral2/memory/5384-1-0x0000000000400000-0x0000000001232000-memory.dmp	themida
behavioral2/memory/5384-33-0x0000000000400000-0x0000000001232000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	X86 Token Finder.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
6	discord.com
19	discord.com
22	discord.com
26	discord.com
36	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

persistence privilege_escalation

Internet Connection Discovery

T1016.001

flow	ioc
6	api.ipify.org
13	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5384	X86 Token Finder.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\DirectX setup.exe	X86 Token Finder.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x001000000001c45b-16.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4404	cmd.exe
5928	cmd.exe
3940	cmd.exe
3096	cmd.exe
1676	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DirectX setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DirectX setup.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	X86 Token Finder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	token finder.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
2404	netsh.exe
5928	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
4308	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DirectX setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DirectX setup.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
5996	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{A7199F3F-0F16-4FFC-AE88-E1CC12B10A9D}	chrome.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
5384	X86 Token Finder.exe
5384	X86 Token Finder.exe
4388	powershell.exe
4388	powershell.exe
4388	powershell.exe
4108	chrome.exe
4108	chrome.exe
2820	WMIC.exe
2820	WMIC.exe
2820	WMIC.exe
2820	WMIC.exe
5920	WMIC.exe
5920	WMIC.exe
5920	WMIC.exe
5920	WMIC.exe
5996	WMIC.exe
5996	WMIC.exe
5996	WMIC.exe
5996	WMIC.exe
4108	chrome.exe
4108	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeIncreaseQuotaPrivilege	2820	WMIC.exe
Token: SeSecurityPrivilege	2820	WMIC.exe
Token: SeTakeOwnershipPrivilege	2820	WMIC.exe
Token: SeLoadDriverPrivilege	2820	WMIC.exe
Token: SeSystemProfilePrivilege	2820	WMIC.exe
Token: SeSystemtimePrivilege	2820	WMIC.exe
Token: SeProfSingleProcessPrivilege	2820	WMIC.exe
Token: SeIncBasePriorityPrivilege	2820	WMIC.exe
Token: SeCreatePagefilePrivilege	2820	WMIC.exe
Token: SeBackupPrivilege	2820	WMIC.exe
Token: SeRestorePrivilege	2820	WMIC.exe
Token: SeShutdownPrivilege	2820	WMIC.exe
Token: SeDebugPrivilege	2820	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2820	WMIC.exe
Token: SeRemoteShutdownPrivilege	2820	WMIC.exe
Token: SeUndockPrivilege	2820	WMIC.exe
Token: SeManageVolumePrivilege	2820	WMIC.exe
Token: 33	2820	WMIC.exe
Token: 34	2820	WMIC.exe
Token: 35	2820	WMIC.exe
Token: 36	2820	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2820	WMIC.exe
Token: SeSecurityPrivilege	2820	WMIC.exe
Token: SeTakeOwnershipPrivilege	2820	WMIC.exe
Token: SeLoadDriverPrivilege	2820	WMIC.exe
Token: SeSystemProfilePrivilege	2820	WMIC.exe
Token: SeSystemtimePrivilege	2820	WMIC.exe
Token: SeProfSingleProcessPrivilege	2820	WMIC.exe
Token: SeIncBasePriorityPrivilege	2820	WMIC.exe
Token: SeCreatePagefilePrivilege	2820	WMIC.exe
Token: SeBackupPrivilege	2820	WMIC.exe
Token: SeRestorePrivilege	2820	WMIC.exe
Token: SeShutdownPrivilege	2820	WMIC.exe
Token: SeDebugPrivilege	2820	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2820	WMIC.exe
Token: SeRemoteShutdownPrivilege	2820	WMIC.exe
Token: SeUndockPrivilege	2820	WMIC.exe
Token: SeManageVolumePrivilege	2820	WMIC.exe
Token: 33	2820	WMIC.exe
Token: 34	2820	WMIC.exe
Token: 35	2820	WMIC.exe
Token: 36	2820	WMIC.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeIncreaseQuotaPrivilege	5920	WMIC.exe
Token: SeSecurityPrivilege	5920	WMIC.exe
Token: SeTakeOwnershipPrivilege	5920	WMIC.exe
Token: SeLoadDriverPrivilege	5920	WMIC.exe
Token: SeSystemProfilePrivilege	5920	WMIC.exe
Token: SeSystemtimePrivilege	5920	WMIC.exe
Token: SeProfSingleProcessPrivilege	5920	WMIC.exe
Token: SeIncBasePriorityPrivilege	5920	WMIC.exe
Token: SeCreatePagefilePrivilege	5920	WMIC.exe
Token: SeBackupPrivilege	5920	WMIC.exe
Token: SeRestorePrivilege	5920	WMIC.exe
Token: SeShutdownPrivilege	5920	WMIC.exe
Token: SeDebugPrivilege	5920	WMIC.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5816	token finder.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5384 wrote to memory of 4388	5384	X86 Token Finder.exe	89
PID 5384 wrote to memory of 5816	5384	X86 Token Finder.exe	91
PID 5384 wrote to memory of 4580	5384	X86 Token Finder.exe	92
PID 4108 wrote to memory of 4176	4108	chrome.exe	94
PID 4580 wrote to memory of 5812	4580	DirectX setup.exe	95
PID 4108 wrote to memory of 1928	4108	chrome.exe	96
PID 4108 wrote to memory of 1928	4108	chrome.exe	96
PID 4108 wrote to memory of 4308	4108	chrome.exe	97
PID 4108 wrote to memory of 3568	4108	chrome.exe	98
PID 4108 wrote to memory of 3568	4108	chrome.exe	98
PID 4108 wrote to memory of 3604	4108	chrome.exe	100
PID 4108 wrote to memory of 3604	4108	chrome.exe	100
PID 4108 wrote to memory of 1472	4108	chrome.exe	101
PID 4108 wrote to memory of 1472	4108	chrome.exe	101
PID 4108 wrote to memory of 3212	4108	chrome.exe	102
PID 4108 wrote to memory of 3212	4108	chrome.exe	102
PID 5812 wrote to memory of 5928	5812	DirectX setup.exe	103
PID 5812 wrote to memory of 4404	5812	DirectX setup.exe	105
PID 4404 wrote to memory of 2820	4404	cmd.exe	107
PID 5928 wrote to memory of 2404	5928	cmd.exe	108
PID 4108 wrote to memory of 5792	4108	chrome.exe	110
PID 4108 wrote to memory of 5792	4108	chrome.exe	110
PID 5812 wrote to memory of 3940	5812	DirectX setup.exe	111
PID 5812 wrote to memory of 3096	5812	DirectX setup.exe	113
PID 3940 wrote to memory of 5920	3940	cmd.exe	114
PID 5812 wrote to memory of 1676	5812	DirectX setup.exe	116
PID 1676 wrote to memory of 5996	1676	cmd.exe	118
PID 4108 wrote to memory of 1304	4108	chrome.exe	120
PID 4108 wrote to memory of 2200	4108	chrome.exe	121
PID 4108 wrote to memory of 2200	4108	chrome.exe	121
PID 4108 wrote to memory of 6056	4108	chrome.exe	122
PID 4108 wrote to memory of 6056	4108	chrome.exe	122
PID 4108 wrote to memory of 5312	4108	chrome.exe	125
PID 4108 wrote to memory of 3244	4108	chrome.exe	126
PID 4108 wrote to memory of 5312	4108	chrome.exe	125
PID 4108 wrote to memory of 3244	4108	chrome.exe	126
PID 4108 wrote to memory of 5588	4108	chrome.exe	127
PID 4108 wrote to memory of 5588	4108	chrome.exe	127
PID 4108 wrote to memory of 5228	4108	chrome.exe	128
PID 4108 wrote to memory of 1904	4108	chrome.exe	130
PID 4108 wrote to memory of 5228	4108	chrome.exe	128
PID 4108 wrote to memory of 2000	4108	chrome.exe	129
PID 4108 wrote to memory of 1904	4108	chrome.exe	130
PID 4108 wrote to memory of 2000	4108	chrome.exe	129
PID 4108 wrote to memory of 2064	4108	chrome.exe	131
PID 4108 wrote to memory of 4064	4108	chrome.exe	133
PID 4108 wrote to memory of 1380	4108	chrome.exe	132
PID 4108 wrote to memory of 2064	4108	chrome.exe	131
PID 4108 wrote to memory of 4064	4108	chrome.exe	133
PID 4108 wrote to memory of 1380	4108	chrome.exe	132
PID 4108 wrote to memory of 108	4108	chrome.exe	134
PID 4108 wrote to memory of 108	4108	chrome.exe	134
PID 4108 wrote to memory of 3784	4108	chrome.exe	135
PID 4108 wrote to memory of 3784	4108	chrome.exe	135
PID 4108 wrote to memory of 4296	4108	chrome.exe	136
PID 4108 wrote to memory of 4296	4108	chrome.exe	136
PID 4108 wrote to memory of 612	4108	chrome.exe	137
PID 4108 wrote to memory of 612	4108	chrome.exe	137
PID 4108 wrote to memory of 5964	4108	chrome.exe	138
PID 4108 wrote to memory of 3212	4108	chrome.exe	139
PID 4108 wrote to memory of 3212	4108	chrome.exe	139
PID 4108 wrote to memory of 6216	4108	chrome.exe	141
PID 4108 wrote to memory of 6224	4108	chrome.exe	142
PID 4108 wrote to memory of 6232	4108	chrome.exe	143

C:\Users\Admin\AppData\Local\Temp\X86 Token Finder.exe
"C:\Users\Admin\AppData\Local\Temp\X86 Token Finder.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAagBzACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAcAB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZQB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGEAbABuACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Users\Admin\token finder.exe
  "C:\Users\Admin\token finder.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5816
- C:\Windows\DirectX setup.exe
  "C:\Windows\DirectX setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\DirectX setup.exe
    "C:\Windows\DirectX setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:5812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:5928
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path softwarelicensingservice get OA3xOriginalProductKey
        5⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where "PartialProductKey is not null" get Name,PartialProductKey /format:csv"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where "PartialProductKey is not null" get Name,PartialProductKey /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:3096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Reads the TCP/IP host and domain name from the registry
        Detects videocard installed
        Suspicious behavior: EnumeratesProcesses
        
        PID:5996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaaebcc728,0x7ffaaebcc734,0x7ffaaebcc740
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,16543838441499657391,316970635404610452,262144 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,5930711174938975859,3130299987943267641,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,17454458653779706395,8968114571282411353,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:13
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,15066557931069800312,16883454758314786752,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,3267377013118513751,6930329820778134287,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4768,i,12381864937365601217,17046778500746201494,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4948,i,8531907309535840267,14800454616381538211,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,7447069288833530200,1313345490467070221,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5788,i,10812765032285901898,5431101503848814650,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5832,i,6713373627729667278,13507723358199879261,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5884,i,4751820437888939607,3506093978717106347,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,8165763326592848231,16835016476345743608,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6080,i,16245927143629148379,100725431148053785,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,3604390850833377776,18023214210814497838,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6104,i,4592894465030363540,9655542889823481057,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6216,i,8803649615943789026,5004385324340028420,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5784,i,18084008784781460641,5187732893229790081,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,4195895587557071905,7906784248314973021,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5180,i,6145619115235526309,7477557470790726143,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5980,i,6811369396161192323,7832695932642536640,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5072,i,1155306854559409898,11366792418107635534,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:9
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6152,i,1204188676941766370,6547192376866264416,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5840,i,6004854120327346503,2688718482109931121,2097152 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6684,i,4803048395698739032,12632517339253086094,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6708,i,1791805317672227476,11109438457267881520,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:12
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,14430215015546564957,30928005418018611,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:6216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7060,i,10971145994250508175,4882160239928251170,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:6224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,15509903088600332148,12425671308056133321,524288 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:6232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3628,i,6826256308084413517,4690884515175101939,262144 --field-trial-handle=1924,i,5389386585334290260,15994983221203199187,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Debugger Evasion

T1622

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

System Information Discovery