TREE TIMELINE VIEW (165 processes, 149 hidden)
ANDRE: a1bab5c7-166a-466d-9226-e37d9eb3c369
8/1/2024, 10:18:05 AM8/2/2024, 7:20:10 AM8/2/2024, 7:20:36 AM8/2/2024, 7:20:43 AM8/2/2024, 7:20:43 AM8/2/2024, 7:20:44 AM8/2/2024, 7:21:00 AM8/2/2024, 7:21:00 AM8/2/2024, 7:21:01 AM8/2/2024, 7:21:01 AM8/2/2024, 7:21:23 AM8/2/2024, 7:21:23 AM8/2/2024, 7:21:25 AM8/2/2024, 7:21:25 AM8/2/2024, 7:21:26 AM8/2/2024, 7:21:26 AM8/2/2024, 7:21:26 AM
kyrazon setup.exe 488 executes kyrazongame-ns.exe.exe 8060kyrazongame-ns.exe.exe 8060 executes cmd.exe 152kyrazongame-ns.exe.exe 8060 executes kyrazongame-ns.exe.exe 11832kyrazongame-ns.exe.exe 8060 executes cmd.exe 11668kyrazongame-ns.exe.exe 8060 executes powershell.exe 2072kyrazongame-ns.exe.exe 8060 executes tasklist.exe 8160kyrazongame-ns.exe.exe 8060 executes reg.exe 6364kyrazongame-ns.exe.exe 8060 executes cmd.exe 13000cmd.exe 152 executes chcp.com 5084cmd.exe 11668 executes findstr.exe 2580powershell.exe 2072 executes conhost.exe 2212tasklist.exe 8160 executes conhost.exe 10464reg.exe 6364 executes conhost.exe 8172cmd.exe 13000 executes conhost.exe 8124cmd.exe 13000 executes reg.exe 12676undefined undefined executes undefined undefinedundefined undefined executes kyrazon setup.exe 488 BootPath:c:\users\ieuser\desktop\kyrazon setup.exe Signed By:Unsigned (Invalid Signer: Image is not signed) Reputation:Unclassifiedkyrazon setup.exe 488Attack Start, Dropped DllUser Execution: Malicious File, Archive Collected DataDropped Executable...Path:c:\users\ieuser\appdata\local\temp\2k4lpey89rbnqfw0cpbjnwkthvq\kyrazongame-ns.exe.exe Signed By:Unsignedkyrazongame-ns.exe.exe 8060Commonly Used Port, Name TrickeryMasquerading, Modify RegistryArchive Collected Data...Path:c:\windows\system32\cmd.exe Arguments:/d /s /c "chcp" Signed By:Microsoft Windows Reputation:Benigncmd.exe 152Command and Scripting Interpreter: Windows Command Shell, Query RegistrySubvert Trust Controls: Code Signing, Native APIPath:c:\windows\system32\chcp.com Signed By:Microsoft Windows Reputation:Benignchcp.com 5084Query Registry, Subvert Trust Controls: Code SigningNative APIPath:c:\users\ieuser\appdata\local\temp\2k4lpey89rbnqfw0cpbjnwkthvq\kyrazongame-ns.exe.exe Arguments:--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\IEUser\AppData\Roaming\KyrazonGame" --field-trial-handle=2244,i,171947... Signed By:Unsignedkyrazongame-ns.exe.exe 11832Name Trickery, Native APIMasquerading, Query RegistryProcess in AppData...Path:c:\windows\system32\cmd.exe Arguments:/d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log"" Signed By:Microsoft Windows Reputation:Benigncmd.exe 11668Command and Scripting Interpreter: Windows Command Shell, Query RegistrySubvert Trust Controls: Code Signing, Native APIPath:c:\windows\system32\findstr.exe Arguments: /C:"Detected boot environment" "C:\Windows\Panther\setupact.log" Signed By:Microsoft Windows Reputation:Benignfindstr.exe 2580Query Registry, Subvert Trust Controls: Code SigningNative APIPath:c:\windows\system32\windowspowershell\v1.0\powershell.exe Arguments:-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command - Signed By:Microsoft Windows Reputation:Benignpowershell.exe 2072Scripting, Query RegistryDropped Script, Indicator Removal on Host: File DeletionCommand and Scripting Interpreter: PowerShell...Path:c:\windows\system32\conhost.exe Arguments:0xffffffff -ForceV1 Signed By:Microsoft Windows Reputation:Benignconhost.exe 2212Query Registry, Subvert Trust Controls: Code SigningNative APIPath:c:\windows\system32\tasklist.exe Arguments:/nh /fo csv Signed By:Microsoft Windows Reputation:Benigntasklist.exe 8160Query Registry, Native APIProcess Discovery, System Information DiscoverySubvert Trust Controls: Code Signing...Path:c:\windows\system32\conhost.exe Arguments:0xffffffff -ForceV1 Signed By:Microsoft Windows Reputation:Benignconhost.exe 10464Query Registry, Subvert Trust Controls: Code SigningNative APIPath:c:\windows\system32\reg.exe Arguments:QUERY HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{07B37198-BD36-4CDF-8F0A-1C83D85347BA} Signed By:Microsoft Windows Reputation:Benignreg.exe 6364Query Registry, Dangerous ExecutionSubvert Trust Controls: Code Signing, Native APIPath:c:\windows\system32\conhost.exe Arguments:0xffffffff -ForceV1 Signed By:Microsoft Windows Reputation:Benignconhost.exe 8172Query Registry, Subvert Trust Controls: Code SigningNative APIPath:c:\windows\system32\cmd.exe Arguments:/d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svchost /t REG_SZ /d C:\Users\IEUser\AppData\Local\Microsoft\Windows\0\svchost.exe /f" Signed By:Microsoft Windows Reputation:Benigncmd.exe 13000Command and Scripting Interpreter: Windows Command Shell, Query RegistrySubvert Trust Controls: Code Signing, Native APIPath:c:\windows\system32\conhost.exe Arguments:0xffffffff -ForceV1 Signed By:Microsoft Windows Reputation:Benignconhost.exe 8124Query Registry, Subvert Trust Controls: Code SigningNative APIPath:c:\windows\system32\reg.exe Arguments: ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svchost /t REG_SZ /d C:\Users\IEUser\AppData\Local\Microsoft\Windows\0\svchost.exe /f Signed By:Microsoft Windows Reputation:Benignreg.exe 12676Trigger: c:\windows\system32\reg.exeQuery Registry, PersistenceRegistry Run Keys / Startup Folder, Subvert Trust Controls: Code SigningModify Registry...Path:undefined Arguments:Unable to decode Signed By:undefined Reputation:undefinedBootHidden Child Processes:1 Click to show all processeskyrazon setup.exe 488 created file kyrazongame-ns.exe.exekyrazon setup.exe 488 created file kyrazongame-ns.exe.exe
^
Process Name:
kyrazon setup.exe
Original Name:
Arguments:
Path:
c:\users\ieuser\desktop\kyrazon setup.exe
PID:
488
Start Time:
8/2/2024, 7:20:10 AM
Close Time:
Duration:
Created By:
c:\windows\explorer.exe
Created By PID:
6048
Parent Chain:
MD5:
a5046a35055c54bf84e3fdfe4a8ed0f7
Signed By:
Unsigned (Invalid Signer: Image is not signed)
User Name:
ANDRE\IEUser
User SID:
S-1-5-21-321011808-3761883066-353627080-1000
SID Name:
Not Applicable - User
Integrity:
Medium
SID Description:
Classification:
Unclassified
Malware Family:
First Seen:
Risk:
34
Severity:
None
Confidence:
None
Detections:
Not Available
Submitted As:
File Type:
File Size (Bytes):
File Version:
Signed By:
Company:
Masquerading: Invalid Code Signature (1 event)
Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files. Unlike Code Signing, this activity will not result in a valid signature. (T1036.001)

Archive Collected Data (1 event)
An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. (T1560)

User Execution: Malicious File (1 event)
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl. [cntrl9][cntrl9][cntrl9]Adversaries may employ various forms of Masquerading on the file to increase the likelihood that a user will open it. [cntrl9][cntrl9][cntrl9]While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. (T1204.002)

Unsigned Process (1 event)
There are many legitimate processes that the developers did not sign. However, please note that the vast majority of malware is unsigned.

Dropped Executable (10 events)
One or more executable files were created.

Dropped Dll (15 events)
One or more Dll files were created.

Query Registry (5 events)
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. (T1012)

Registry Run Keys / Startup Folder, Subvert Trust Controls: Code Signing
Legend
Close
Arguments: