898b76898212de9f30fbbcba7d487a56b6299799ad27f26518340a3d0f78aeb7

Analysis

max time kernel
118s
max time network
122s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
11-12-2023 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
Size

1.7MB
MD5

85fba30ac904c4d99e3f7e355eb00969
SHA1

1535a6371eba36aab9f7a996ef6062470af7f47d
SHA256

a55785a92318115545cb0e3131958994c6c4f301becaaee3050d85e212f5c332
SHA512

2ceb5d22ec6717c9c89cd1edf116565d307d0ad65dd5dd7956902c62c091a3d211dc275c552599a3d35c199bb1d5c7ec1655a6ce8012c30d20b0cb2fdcb06892
SSDEEP

24576:rwCcpAmiqHyDUU4+h0bz4iFjBUjkkE3dawlDSVXT5XUsjya:rEpACyDd4+h0n4yU71XT5XL1

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Control Panel\International\Geo\Nation	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Packa = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8ada118edb2bda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7056ab8ddb2bda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c8c9df8ddb2bda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{F40218C9-7E77-44D2-87B4-38DFC498D567} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2428	MicrosoftEdgeCP.exe
2428	MicrosoftEdgeCP.exe
2428	MicrosoftEdgeCP.exe
2428	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
Token: SeDebugPrivilege	2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
Token: SeDebugPrivilege	3656	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3656	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3656	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3656	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3220	MicrosoftEdge.exe
Token: SeDebugPrivilege	3220	MicrosoftEdge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2332	Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3220	MicrosoftEdge.exe
2428	MicrosoftEdgeCP.exe
3656	MicrosoftEdgeCP.exe
2428	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe
"C:\Users\Admin\AppData\Local\Temp\Baldurs Gate 3 v4.1.1 Plus 21 Trainer Updated 2023.12.01.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2332

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3220

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:516

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2428

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3656

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF9A1DA6D79543C68B.TMP

Filesize
16KB

MD5
47db8242ef091abc215b05575f468de2

SHA1
b9c673707f202b4baca36ac2315b6884d4660157

SHA256
153567b04e38ede69427d1cf01eaf93f14c1c84dd47002170e71f91409ff3823

SHA512
dff1a742186e97f088815115eb3c938a0535212b718faea4b8e8cdfb1229a5317cbea2f04736d415eb71bfc708ffd0fa726cfdba8a411edf49a510384e0410b7

Download Submit
memory/2332-20-0x00007FFDC9360000-0x00007FFDC9D4C000-memory.dmp

Filesize
9.9MB

Download
memory/2332-22-0x00000213CDC70000-0x00000213CDC80000-memory.dmp

Filesize
64KB

Download
memory/2332-3-0x00000213CDC70000-0x00000213CDC80000-memory.dmp

Filesize
64KB

Download
memory/2332-4-0x00000213D1C90000-0x00000213D1C98000-memory.dmp

Filesize
32KB

Download
memory/2332-5-0x00000213D1D10000-0x00000213D1D48000-memory.dmp

Filesize
224KB

Download
memory/2332-0-0x00000213B51A0000-0x00000213B51D4000-memory.dmp

Filesize
208KB

Download
memory/2332-21-0x00000213CDC70000-0x00000213CDC80000-memory.dmp

Filesize
64KB

Download
memory/2332-2-0x00000213CDC70000-0x00000213CDC80000-memory.dmp

Filesize
64KB

Download
memory/2332-1-0x00007FFDC9360000-0x00007FFDC9D4C000-memory.dmp

Filesize
9.9MB

Download
memory/3220-58-0x000002571DA90000-0x000002571DA92000-memory.dmp

Filesize
8KB

Download
memory/3220-39-0x000002571DC00000-0x000002571DC10000-memory.dmp

Filesize
64KB

Download
memory/3220-290-0x0000025721E70000-0x0000025721E72000-memory.dmp

Filesize
8KB

Download
memory/3220-293-0x0000025721D00000-0x0000025721D01000-memory.dmp

Filesize
4KB

Download
memory/3220-297-0x000002571D6F0000-0x000002571D6F1000-memory.dmp

Filesize
4KB

Download