sodinokibi | fc55832f34eac686d40ca7b0080b9b67365421626fb0fbb0dafccf6373e984f2

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\t32mMaunsR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe"	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe

Enumerates connected drives 3 TTPs 26 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\J:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\N:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\W:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\Y:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\B:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\F:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\E:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\D:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\H:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\L:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\Q:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\U:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\F:	NOTEPAD.EXE
File opened (read-only)	\??\I:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\S:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\Z:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\T:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\V:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\G:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\M:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\X:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\A:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\K:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\O:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\P:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened (read-only)	\??\R:	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1184116928-951304463-2249875399-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u34ftu1tsa9r.bmp"	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\UnlockConvertFrom.search-ms	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\UnregisterDebug.potx	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\WatchPing.pptx	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\SetSend.mpeg3	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File created	\??\c:\program files\6cm98-readme.txt	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File created	\??\c:\program files (x86)\6cm98-readme.txt	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\PublishPing.m3u	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\ResolveLimit.jpeg	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File created	\??\c:\program files\tmp	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\BackupCheckpoint.wmf	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\EditResolve.DVR-MS	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\HideInstall.001	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\JoinExit.m1v	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\ResizeExport.temp	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\ResolveRead.doc	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File created	\??\c:\program files (x86)\tmp	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\PopUnblock.ogg	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\RepairGrant.MTS	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\RestoreUnprotect.docx	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\ResumeReceive.php	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\UninstallProtect.jpg	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
File opened for modification	\??\c:\program files\PingStop.potx	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1184116928-951304463-2249875399-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "235"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1184116928-951304463-2249875399-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1184116928-951304463-2249875399-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1184116928-951304463-2249875399-1000\{26FE2A63-0907-4F77-A4B7-69B260737F80}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1784	vlc.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
4936	msedge.exe
4936	msedge.exe
3272	msedge.exe
3272	msedge.exe
2684	msedge.exe
2684	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1784	vlc.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
2056	Process not Found
3184	Process not Found
2620	Process not Found
1356	Process not Found
4000	Process not Found
2784	Process not Found
2368	Process not Found
1560	Process not Found
2840	Process not Found
3588	Process not Found
3380	Process not Found
4804	Process not Found
3348	Process not Found
880	Process not Found
2176	Process not Found
2320	Process not Found
4168	Process not Found
4936	Process not Found
4340	Process not Found
2528	Process not Found
312	Process not Found
4484	Process not Found
2700	Process not Found
2600	Process not Found
1852	Process not Found
2776	Process not Found
4912	Process not Found
2724	Process not Found
3304	Process not Found
796	Process not Found
3704	Process not Found
5108	Process not Found
4444	Process not Found
2968	Process not Found
4608	Process not Found
232	Process not Found
3400	Process not Found
4208	Process not Found
2372	Process not Found
4080	Process not Found
1116	Process not Found
1432	Process not Found
3744	Process not Found
320	Process not Found
3052	Process not Found
3004	Process not Found
540	Process not Found
304	Process not Found
4920	Process not Found
1740	Process not Found
1056	Process not Found
2516	Process not Found
4864	Process not Found
2228	Process not Found
3476	Process not Found
3516	Process not Found
3084	Process not Found
3544	Process not Found
4672	Process not Found
2912	Process not Found
4520	Process not Found
4152	Process not Found
2484	Process not Found
3812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
Token: SeTakeOwnershipPrivilege	4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
344	AcroRd32.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
4920	firefox.exe
4920	firefox.exe
4920	firefox.exe
4920	firefox.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1784	vlc.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
4920	firefox.exe
4920	firefox.exe
4920	firefox.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4056	OpenWith.exe
1784	vlc.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
344	AcroRd32.exe
1852	firefox.exe
4920	firefox.exe
2160	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4976	4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe	77
PID 4744 wrote to memory of 4976	4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe	77
PID 4744 wrote to memory of 4976	4744	03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe	77
PID 344 wrote to memory of 928	344	AcroRd32.exe	97
PID 344 wrote to memory of 928	344	AcroRd32.exe	97
PID 344 wrote to memory of 928	344	AcroRd32.exe	97
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 4860	928	RdrCEF.exe	98
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99
PID 928 wrote to memory of 3504	928	RdrCEF.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe
"C:\Users\Admin\AppData\Local\Temp\03b5a7ffe111cca63fc687a295ba8075087cc90812f6b988797a2d49a5db1482.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
  2⤵
  - Modifies Windows Firewall
  PID:4976

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2704

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""
1⤵
PID:1528

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4056

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SetRename.mpa"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1784

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:344
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=20972A6EC855B8A0542394077E51E438 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=20972A6EC855B8A0542394077E51E438 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=475F648EB459EB016BC046310BE4587E --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3504
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0EA59AF5440D03BF1A130088245CFE3A --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:312
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D186714FE471DC7F7D6A71463F6D1818 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4512
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C67F02DBCB694B488857E59EC6746FD3 --mojo-platform-channel-handle=2540 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" F:\6cm98-readme.txt
1⤵
- Enumerates connected drives
PID:2464

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:788
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1852.0.51402750\1252941364" -parentBuildID 20221007134813 -prefsHandle 1792 -prefMapHandle 1772 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1aaf37c4-3f68-432b-95ee-6cf5b46dc5a3} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" 1872 240a0208c58 gpu
    3⤵
    PID:4824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1852.1.130700011\1955102260" -parentBuildID 20221007134813 -prefsHandle 2236 -prefMapHandle 2232 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f1a2b58-1008-4ea1-90c3-ccf492a3590f} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" 2248 2409effb158 socket
    3⤵
    PID:1952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1852.2.2047609184\1085185313" -childID 1 -isForBrowser -prefsHandle 3260 -prefMapHandle 3148 -prefsLen 20821 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f18f8ae5-3024-47ee-a725-40819a9d8d6d} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" 3028 2409f05f058 tab
    3⤵
    PID:4216

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4920
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.0.1501504043\1427044457" -parentBuildID 20221007134813 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 20747 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {359f7dd1-6a0a-427f-a2e2-a97e09e5bef9} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 1836 2079e8f5b58 gpu
  2⤵
  PID:2936
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.1.377733387\156135328" -parentBuildID 20221007134813 -prefsHandle 2200 -prefMapHandle 2196 -prefsLen 20783 -prefMapSize 233496 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b97bb59-451e-4e5b-98db-08f1b0345f9b} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 2212 2079daddb58 socket
  2⤵
  PID:1056
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4920.2.653053214\2100765554" -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 3024 -prefsLen 20886 -prefMapSize 233496 -jsInitHandle 988 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e86c253-f00e-4389-9b13-531960c86f96} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 1620 207a3bf0558 tab
  2⤵
  PID:3736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff13683cb8,0x7fff13683cc8,0x7fff13683cd8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,6581436770508738375,11675135126453808959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4236

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c7055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery