vidar | 73c1c8ae9461ae24e38f8ce58aa5d5837ddf773b46bfb43127f8417dac8034be

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	LuckyWheel.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	LuckyWheel.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	LuckyWheel.exe

Executes dropped EXE 3 IoCs

pid	Process
4636	LuckyWheel.exe
724	WindowsServices.exe
4692	pub3.exe

Loads dropped DLL 11 IoCs

pid	Process
1248	tmp.exe
1248	tmp.exe
1248	tmp.exe
1248	tmp.exe
1248	tmp.exe
1248	tmp.exe
1248	tmp.exe
1248	tmp.exe
1248	tmp.exe
4692	pub3.exe
4692	pub3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsServices = "C:\\Program Files (x86)\\LuckyWheel\\WindowsServices.exe"	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LuckyWheel = "C:\\Program Files (x86)\\LuckyWheel\\LuckyWheel.exe"	tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LuckyWheel = "C:\\Program Files (x86)\\LuckyWheel\\LuckyWheel.exe"	tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	tmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LuckyWheel.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LuckyWheel\Newtonsoft.Json.dll	tmp.exe
File created	C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe	tmp.exe
File created	C:\Program Files (x86)\LuckyWheel\WindowsServices.exe	tmp.exe
File created	C:\Program Files (x86)\LuckyWheel\kill.bat	tmp.exe
File created	C:\Program Files (x86)\LuckyWheel\pub3.exe	LuckyWheel.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\469f9299-867e-4bb8-b65e-42d184fba527.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230505223258.pma	setup.exe
File created	C:\Program Files (x86)\LuckyWheel\ADSSTrayPopup.dll	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pub3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pub3.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 19 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31031201"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31031201"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{99265771-EB94-11ED-9F77-6201C35E5273} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1935336022"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1935803189"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1248	tmp.exe
1248	tmp.exe
1248	tmp.exe
1248	tmp.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
1280	msedge.exe
1280	msedge.exe
4692	pub3.exe
4692	pub3.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe
4636	LuckyWheel.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	LuckyWheel.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1208	iexplore.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4636	LuckyWheel.exe
4636	LuckyWheel.exe
1208	iexplore.exe
1208	iexplore.exe
4032	IEXPLORE.EXE
4032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 4636	1248	tmp.exe	84
PID 1248 wrote to memory of 4636	1248	tmp.exe	84
PID 1248 wrote to memory of 724	1248	tmp.exe	85
PID 1248 wrote to memory of 724	1248	tmp.exe	85
PID 1248 wrote to memory of 4276	1248	tmp.exe	88
PID 1248 wrote to memory of 4276	1248	tmp.exe	88
PID 4276 wrote to memory of 372	4276	msedge.exe	89
PID 4276 wrote to memory of 372	4276	msedge.exe	89
PID 4636 wrote to memory of 4692	4636	LuckyWheel.exe	93
PID 4636 wrote to memory of 4692	4636	LuckyWheel.exe	93
PID 4636 wrote to memory of 4692	4636	LuckyWheel.exe	93
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 4400	4276	msedge.exe	96
PID 4276 wrote to memory of 1280	4276	msedge.exe	97
PID 4276 wrote to memory of 1280	4276	msedge.exe	97
PID 4276 wrote to memory of 2284	4276	msedge.exe	100
PID 4276 wrote to memory of 2284	4276	msedge.exe	100
PID 4276 wrote to memory of 2284	4276	msedge.exe	100
PID 4276 wrote to memory of 2284	4276	msedge.exe	100
PID 4276 wrote to memory of 2284	4276	msedge.exe	100
PID 4276 wrote to memory of 2284	4276	msedge.exe	100
PID 4276 wrote to memory of 2284	4276	msedge.exe	100
PID 4276 wrote to memory of 2284	4276	msedge.exe	100
PID 4276 wrote to memory of 2284	4276	msedge.exe	100
PID 4276 wrote to memory of 2284	4276	msedge.exe	100
PID 4276 wrote to memory of 2284	4276	msedge.exe	100

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	LuckyWheel.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	LuckyWheel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1248
- C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe
  "C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4636
- - C:\Program Files (x86)\LuckyWheel\pub3.exe
    "C:\Program Files (x86)\LuckyWheel\pub3.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4692
- C:\Program Files (x86)\LuckyWheel\WindowsServices.exe
  "C:\Program Files (x86)\LuckyWheel\WindowsServices.exe"
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://zwoops.com/Escott/
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb286046f8,0x7ffb28604708,0x7ffb28604718
    3⤵
    PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1836744820536091802,13834996732211254993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1836744820536091802,13834996732211254993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,1836744820536091802,13834996732211254993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1836744820536091802,13834996732211254993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1836744820536091802,13834996732211254993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1836744820536091802,13834996732211254993,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1836744820536091802,13834996732211254993,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1836744820536091802,13834996732211254993,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1836744820536091802,13834996732211254993,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1836744820536091802,13834996732211254993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x130,0x204,0x228,0x11c,0x22c,0x7ff71b075460,0x7ff71b075470,0x7ff71b075480
      4⤵
      PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1836744820536091802,13834996732211254993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
    3⤵
    PID:3664

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{D5E8041D-920F-45e9-B8FB-B1DEB82C6E5E} -Embedding
1⤵
PID:4272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3424

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1208 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery