bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in System32 directory 55 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kuaijie.bat	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\kuaijie.bat	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\激情爽片.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\FilmTVkk.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\免费电影.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\FilmTVkk.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\qq.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\淘宝购物.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\免费电影.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\sy.reg	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\yx.url	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\sp.url	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\ss.reg	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\ss.reg	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\腾讯QQ.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\腾讯QQ.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\FilmTVkk.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\sp.url	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\zq.url	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\filmtvdy.exe.exe	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\mm.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\yx.url	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\filmtvdy.exe.exe	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\ico.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\yx.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\hosok.bat	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\taobao.url	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\FilmTVkk.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\hosok.bat	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\zq.url	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\systemkj.vbs	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\zq.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\yx.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\mm.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\qq.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\taobao.url	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\yx.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\zq.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\激情爽片.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\淘宝购物.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\zq.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\systemok.vbs	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\taobao.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\Internet ExpIorer.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\ico.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\Internet ExpIorer.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\Internet ExpIorer.url	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\sy.reg	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\taobao.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\zq.ico	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\yx.lnk	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\Internet ExpIorer.url	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\__tmp_rar_sfx_access_check_240570484	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File opened for modification	C:\Windows\SysWOW64\systemkj.vbs	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
File created	C:\Windows\SysWOW64\systemok.vbs	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\027f3046-b1ee-4355-b6c0-71bb1bf80d2e.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221205203407.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\GPU	filmtvdy.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	filmtvdy.exe.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.7802.com/"	regedit.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3856	regedit.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
4036	msedge.exe
4036	msedge.exe
496	identity_helper.exe
496	identity_helper.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4852	filmtvdy.exe.exe
4852	filmtvdy.exe.exe
4852	filmtvdy.exe.exe
4852	filmtvdy.exe.exe
4852	filmtvdy.exe.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4852	filmtvdy.exe.exe
4852	filmtvdy.exe.exe
4852	filmtvdy.exe.exe
4852	filmtvdy.exe.exe
4852	filmtvdy.exe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4852	filmtvdy.exe.exe
4852	filmtvdy.exe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3204	3008	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe	83
PID 3008 wrote to memory of 3204	3008	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe	83
PID 3008 wrote to memory of 3204	3008	bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe	83
PID 3204 wrote to memory of 3152	3204	WScript.exe	84
PID 3204 wrote to memory of 3152	3204	WScript.exe	84
PID 3204 wrote to memory of 3152	3204	WScript.exe	84
PID 3152 wrote to memory of 1384	3152	cmd.exe	86
PID 3152 wrote to memory of 1384	3152	cmd.exe	86
PID 3152 wrote to memory of 1384	3152	cmd.exe	86
PID 3152 wrote to memory of 232	3152	cmd.exe	87
PID 3152 wrote to memory of 232	3152	cmd.exe	87
PID 3152 wrote to memory of 232	3152	cmd.exe	87
PID 3152 wrote to memory of 228	3152	cmd.exe	88
PID 3152 wrote to memory of 228	3152	cmd.exe	88
PID 3152 wrote to memory of 228	3152	cmd.exe	88
PID 228 wrote to memory of 4468	228	rundll32.exe	89
PID 228 wrote to memory of 4468	228	rundll32.exe	89
PID 228 wrote to memory of 4468	228	rundll32.exe	89
PID 4468 wrote to memory of 4496	4468	runonce.exe	90
PID 4468 wrote to memory of 4496	4468	runonce.exe	90
PID 4468 wrote to memory of 4496	4468	runonce.exe	90
PID 3152 wrote to memory of 3856	3152	cmd.exe	92
PID 3152 wrote to memory of 3856	3152	cmd.exe	92
PID 3152 wrote to memory of 3856	3152	cmd.exe	92
PID 3152 wrote to memory of 4036	3152	cmd.exe	93
PID 3152 wrote to memory of 4036	3152	cmd.exe	93
PID 3152 wrote to memory of 4852	3152	cmd.exe	95
PID 3152 wrote to memory of 4852	3152	cmd.exe	95
PID 3152 wrote to memory of 4852	3152	cmd.exe	95
PID 3152 wrote to memory of 3668	3152	cmd.exe	96
PID 3152 wrote to memory of 3668	3152	cmd.exe	96
PID 3152 wrote to memory of 3668	3152	cmd.exe	96
PID 4036 wrote to memory of 3380	4036	msedge.exe	97
PID 4036 wrote to memory of 3380	4036	msedge.exe	97
PID 3152 wrote to memory of 4648	3152	cmd.exe	98
PID 3152 wrote to memory of 4648	3152	cmd.exe	98
PID 3152 wrote to memory of 4648	3152	cmd.exe	98
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100
PID 4036 wrote to memory of 448	4036	msedge.exe	100

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3668	attrib.exe
4648	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe
"C:\Users\Admin\AppData\Local\Temp\bc0462735776c401e0998d4c595a5dd7fa740ade386f0eb28d36901febc2cdf7.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\system32\systemok.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\WINDOWS\system32\hosok.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\SysWOW64\reg.exe
      Reg Add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t "REG_DWORD" /d "1" /f
      4⤵
      PID:1384
  - - C:\Windows\SysWOW64\reg.exe
      Reg Add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t "REG_DWORD" /d "1" /f
      4⤵
      PID:232
  - - C:\Windows\SysWOW64\rundll32.exe
      RUNDLL32 SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\TmpInf.inf
      4⤵
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:4468
      - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:4496
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s sy.reg
      4⤵
      Modifies Internet Explorer settings
      Modifies Internet Explorer start page
      Runs .reg file with regedit
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.7802.com/index1.html
      4⤵
      Adds Run key to start application
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc532246f8,0x7ffc53224708,0x7ffc53224718
        5⤵
        
        PID:3380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        5⤵
        
        PID:448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
        5⤵
        
        PID:5016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
        5⤵
        
        PID:3120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:5020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4460 /prefetch:8
        5⤵
        
        PID:2496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
        5⤵
        
        PID:2844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5660 /prefetch:8
        5⤵
        
        PID:3516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
        5⤵
        
        PID:952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
        5⤵
        
        PID:1120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
        5⤵
        
        PID:4704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        
        PID:3200
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x1bc,0x1c4,0x228,0x204,0x22c,0x7ff7ee7e5460,0x7ff7ee7e5470,0x7ff7ee7e5480
        6⤵
        
        PID:1312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1816 /prefetch:8
        5⤵
        
        PID:656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:8
        5⤵
        
        PID:2236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1940 /prefetch:8
        5⤵
        
        PID:2680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
        5⤵
        
        PID:2616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3652 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,8829323258893988423,5636563865467203956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
        5⤵
        
        PID:3924
  - - C:\Windows\SysWOW64\filmtvdy.exe.exe
      filmtvdy.exe.exe
      4⤵
      Executes dropped EXE
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:4852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\╫└├µ\*.lnk" +R +S
      4⤵
      Views/modifies file attributes
      PID:3668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\*.lnk" +R +S
      4⤵
      Views/modifies file attributes
      PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery