kaiten | hxxp://www[.]malwaredomainlist[.]com/mdl[.]php

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

python-3.12.2-amd64.exepython-3.12.2-amd64.exepython-3.12.2-amd64.exepython-3.12.2-amd64 (1).exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64 (1).exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.12\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

Processes:

flow	ioc
177	camo.githubusercontent.com
183	camo.githubusercontent.com
184	camo.githubusercontent.com
185	camo.githubusercontent.com
186	camo.githubusercontent.com
187	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e670bfd.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{94087C99-E4F5-4637-A789-3B6059DF787B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB852.tmp	msiexec.exe
File created	C:\Windows\Installer\e671e6f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e671e74.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e671e79.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e670bee.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}	msiexec.exe
File created	C:\Windows\Installer\e670c01.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}	msiexec.exe
File created	C:\Windows\Installer\e670c15.msi	msiexec.exe
File created	C:\Windows\Installer\e671e64.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF55.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e670c02.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2655.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI19F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAD4.tmp	msiexec.exe
File created	C:\Windows\Installer\e671e78.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B8B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCE2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2377.tmp	msiexec.exe
File created	C:\Windows\Installer\e671e79.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI128F.tmp	msiexec.exe
File created	C:\Windows\Installer\e671e73.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e670be9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e670bf7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E1C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB8FF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE6A.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	msiexec.exe
File opened for modification	C:\Windows\Installer\e670c0c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI28C7.tmp	msiexec.exe
File created	C:\Windows\Installer\e671e5a.msi	msiexec.exe
File created	C:\Windows\Installer\e671e69.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B1A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A7C.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3B36061E-A25F-4E12-BFD1-68E724723D48}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7393.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e670c11.msi	msiexec.exe
File created	C:\Windows\Installer\e671e5f.msi	msiexec.exe
File created	C:\Windows\Installer\e670c0c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF0B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFC1.tmp	msiexec.exe
File created	C:\Windows\Installer\e670bed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6D0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e671e60.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e671e65.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID64E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI126F.tmp	msiexec.exe
File created	C:\Windows\Installer\e671e7d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDBE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e670bf8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F05.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BD32BDE9-835D-4013-8F9A-45FF11456F02}	msiexec.exe
File created	C:\Windows\Installer\e670c0b.msi	msiexec.exe
File created	C:\Windows\Installer\e671e5b.msi	msiexec.exe
File created	C:\Windows\Installer\e670be9.msi	msiexec.exe
File created	C:\Windows\Installer\e670bfc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e670c07.msi	msiexec.exe
File created	C:\Windows\Installer\e670c10.msi	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 4070dc80f664da01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4165120413"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f56c9fc408eeab4dbb98e5396bd9a76d000000000200000000001066000000010000200000001ea8a20189179e2c44a6cecabdcad99e8de35e0c0a768a5cfccacfdbbfff086c000000000e8000000002000020000000896fffc4628e077b363efea88f0f605bd1fa7222c0849fc122ee466782e62fdd20000000e0e7e8967db2d2e7cb8ba077c6729d254767f1e81d761d8da51020341ab8484240000000a0f90997c2877b6cb48cd6fd0108807b17ea42fdfb72cf37dff01bba5bb4114821ee0ededabff05731926ace437e3def0659ed2c915f9b5df176a08dd0c36802	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415336063"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4168870427"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50aaa8f83b65da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{23E48341-D12F-11EE-B8F3-FA4A7D754358} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e012cff63c65da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31089979"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f56c9fc408eeab4dbb98e5396bd9a76d000000000200000000001066000000010000200000005ef54354cb25fd64dbf4a69d8f2815dd95154d9ee938ba6fb5a447bb2100df41000000000e8000000002000020000000240d3728749843cec2b53d4be961db07457be96f732ee816619d1f9f459b506420000000584fd843ffaf5588b5f2edd0f1c241da2022a00e68d5e9133b6324455d2c9e2e400000004355db66b3c8ee8baf89d9f2f3975a2e59a0f427cddb16afc9652fd0c0649cce800282e0cd3447c855125f171f5cf1addf3a16b11c8c97e5883e5a7647423572	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31089979"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4065adf83b65da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{33D4A122-D130-11EE-B8F3-FA4A7D754358} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31089979"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{07315A6F-201A-47C8-A64D-74C60AB7DFF1}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4165120413"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f56c9fc408eeab4dbb98e5396bd9a76d00000000020000000000106600000001000020000000516b625e5028d655ec33120ba437705f54582aa68d033ad7f2fdd8dd36042931000000000e8000000002000020000000fb57605c5419d84b3824bca667162661b379c8b9a9c689656577eab2b1d509a02000000090cebb9b45c1f9a7ee9db4f3853321d81736453227f35a2d366ba26ac7c748ac40000000e0b99f54df23aad5d12b0a854792c5ce27f5f408611e7228d64d2eef7776b8e097d3cb0892b8b470e718cd090ff14b5b0658e6a99a3e56153277df93a28f37bc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exepython-3.12.2-amd64.exepython-3.12.2-amd64.exepython-3.12.2-amd64 (1).exepython-3.12.2-amd64.exemsedge.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{BD32BDE9-835D-4013-8F9A-45FF11456F02}	python-3.12.2-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\ = "{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}"	python-3.12.2-amd64 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{3B36061E-A25F-4E12-BFD1-68E724723D48}\ = "{3B36061E-A25F-4E12-BFD1-68E724723D48}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.NoConArchiveFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.File\Shell\editwithidle\shell\edit312	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_CLASSES\INSTALLER\DEPENDENCIES\{3B36061E-A25F-4E12-BFD1-68E724723D48}\DEPENDENTS\{B6178A40-1665-4565-B73E-48DD6E039A65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}\ = "{94087C99-E4F5-4637-A789-3B6059DF787B}"	python-3.12.2-amd64 (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.File\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.Extension\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}	python-3.12.2-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}\Dependents	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\DisplayName = "Python 3.12.2 Core Interpreter (64-bit)"	python-3.12.2-amd64 (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\.pyo\ = "Python.CompiledFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}	python-3.12.2-amd64 (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_CLASSES\INSTALLER\DEPENDENCIES\{BDE73EDC-76AE-475D-8885-9B583631B0FC}\DEPENDENTS\{B6178A40-1665-4565-B73E-48DD6E039A65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\﷐翽\ = "diz_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.File\Shell\editwithidle\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.CompiledFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}\ = "{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}"	python-3.12.2-amd64 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.File\Shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\Dependents	python-3.12.2-amd64 (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{BD32BDE9-835D-4013-8F9A-45FF11456F02}\ = "{BD32BDE9-835D-4013-8F9A-45FF11456F02}"	python-3.12.2-amd64 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\diz_auto_file\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\.pyw\ = "Python.NoConFile"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\ = "{4534F2ED-1616-434D-98A6-0DA358DCD466}"	python-3.12.2-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\CPython-3.12	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	python-3.12.2-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.File\Shell\editwithidle\shell	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\Dependents	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.File\ = "Python File"	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.NoConFile\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.NoConFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{BDE73EDC-76AE-475D-8885-9B583631B0FC}\ = "{BDE73EDC-76AE-475D-8885-9B583631B0FC}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\.pyw	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\diz_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.File\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.CompiledFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.NoConArchiveFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",5"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Installer\Dependencies\{BD32BDE9-835D-4013-8F9A-45FF11456F02}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64 (1).exe
Key deleted	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000_Classes\Python.NoConArchiveFile\shell\open	msiexec.exe

NTFS ADS 2 IoCs

Processes:

msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 813935.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 758413.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1312 NOTEPAD.EXE

pid	process
1312	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe7zFM.exemsedge.exemsedge.exemsedge.exemsiexec.exetaskmgr.exe

pid	process
1748	msedge.exe
1748	msedge.exe
4524	msedge.exe
4524	msedge.exe
2348	identity_helper.exe
2348	identity_helper.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1752	msedge.exe
1752	msedge.exe
1052	7zFM.exe
1052	7zFM.exe
4824	msedge.exe
4824	msedge.exe
4168	msedge.exe
4168	msedge.exe
2860	msedge.exe
2860	msedge.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
1828	msiexec.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 7 IoCs

Processes:

7zFM.exeOpenWith.exe7zFM.exeOpenWith.exeOpenWith.exeOpenWith.exetaskmgr.exe

pid process

2596 7zFM.exe
4356 OpenWith.exe
1052 7zFM.exe
2512 OpenWith.exe
5092 OpenWith.exe
2160 OpenWith.exe
3536 taskmgr.exe

pid	process
2596	7zFM.exe
4356	OpenWith.exe
1052	7zFM.exe
2512	OpenWith.exe
5092	OpenWith.exe
2160	OpenWith.exe
3536	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 36 IoCs

Processes:

msedge.exe

pid	process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exe7zG.exe7zFM.exepython-3.12.2-amd64.exemsiexec.exe

description	pid	process
Token: SeRestorePrivilege	2596	7zFM.exe
Token: 35	2596	7zFM.exe
Token: SeSecurityPrivilege	2596	7zFM.exe
Token: SeSecurityPrivilege	2596	7zFM.exe
Token: SeRestorePrivilege	2404	7zG.exe
Token: 35	2404	7zG.exe
Token: SeSecurityPrivilege	2404	7zG.exe
Token: SeSecurityPrivilege	2404	7zG.exe
Token: SeRestorePrivilege	1052	7zFM.exe
Token: 35	1052	7zFM.exe
Token: SeSecurityPrivilege	1052	7zFM.exe
Token: SeSecurityPrivilege	1052	7zFM.exe
Token: SeShutdownPrivilege	1948	python-3.12.2-amd64.exe
Token: SeIncreaseQuotaPrivilege	1948	python-3.12.2-amd64.exe
Token: SeSecurityPrivilege	1828	msiexec.exe
Token: SeCreateTokenPrivilege	1948	python-3.12.2-amd64.exe
Token: SeAssignPrimaryTokenPrivilege	1948	python-3.12.2-amd64.exe
Token: SeLockMemoryPrivilege	1948	python-3.12.2-amd64.exe
Token: SeIncreaseQuotaPrivilege	1948	python-3.12.2-amd64.exe
Token: SeMachineAccountPrivilege	1948	python-3.12.2-amd64.exe
Token: SeTcbPrivilege	1948	python-3.12.2-amd64.exe
Token: SeSecurityPrivilege	1948	python-3.12.2-amd64.exe
Token: SeTakeOwnershipPrivilege	1948	python-3.12.2-amd64.exe
Token: SeLoadDriverPrivilege	1948	python-3.12.2-amd64.exe
Token: SeSystemProfilePrivilege	1948	python-3.12.2-amd64.exe
Token: SeSystemtimePrivilege	1948	python-3.12.2-amd64.exe
Token: SeProfSingleProcessPrivilege	1948	python-3.12.2-amd64.exe
Token: SeIncBasePriorityPrivilege	1948	python-3.12.2-amd64.exe
Token: SeCreatePagefilePrivilege	1948	python-3.12.2-amd64.exe
Token: SeCreatePermanentPrivilege	1948	python-3.12.2-amd64.exe
Token: SeBackupPrivilege	1948	python-3.12.2-amd64.exe
Token: SeRestorePrivilege	1948	python-3.12.2-amd64.exe
Token: SeShutdownPrivilege	1948	python-3.12.2-amd64.exe
Token: SeDebugPrivilege	1948	python-3.12.2-amd64.exe
Token: SeAuditPrivilege	1948	python-3.12.2-amd64.exe
Token: SeSystemEnvironmentPrivilege	1948	python-3.12.2-amd64.exe
Token: SeChangeNotifyPrivilege	1948	python-3.12.2-amd64.exe
Token: SeRemoteShutdownPrivilege	1948	python-3.12.2-amd64.exe
Token: SeUndockPrivilege	1948	python-3.12.2-amd64.exe
Token: SeSyncAgentPrivilege	1948	python-3.12.2-amd64.exe
Token: SeEnableDelegationPrivilege	1948	python-3.12.2-amd64.exe
Token: SeManageVolumePrivilege	1948	python-3.12.2-amd64.exe
Token: SeImpersonatePrivilege	1948	python-3.12.2-amd64.exe
Token: SeCreateGlobalPrivilege	1948	python-3.12.2-amd64.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe
Token: SeRestorePrivilege	1828	msiexec.exe
Token: SeTakeOwnershipPrivilege	1828	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe
3536	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

OpenWith.exeiexplore.exeIEXPLORE.EXEOpenWith.exe

pid	process
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
4356	OpenWith.exe
832	iexplore.exe
832	iexplore.exe
3992	IEXPLORE.EXE
3992	IEXPLORE.EXE
3992	IEXPLORE.EXE
3992	IEXPLORE.EXE
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4524 wrote to memory of 1764	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 1764	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2028	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 1748	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 1748	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe
PID 4524 wrote to memory of 2724	4524	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
1⤵
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
1⤵
PID:3256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
1⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
1⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe037846f8,0x7ffe03784708,0x7ffe03784718
1⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.malwaredomainlist.com/mdl.php
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2044 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\viruses-20060327.tar.bz2"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1056 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
  "C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:404
- - C:\Windows\Temp\{2ECFC815-C69C-4879-97E6-05F41D17B487}\.cr\python-3.12.2-amd64.exe
    "C:\Windows\Temp\{2ECFC815-C69C-4879-97E6-05F41D17B487}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=568
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
  "C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:5368
- - C:\Windows\Temp\{C5361910-B9EF-45AB-8626-A6D13E84A576}\.cr\python-3.12.2-amd64.exe
    "C:\Windows\Temp\{C5361910-B9EF-45AB-8626-A6D13E84A576}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=692
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:5200
- C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
  "C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:4780
- - C:\Windows\Temp\{89DE4649-7562-40F2-95BD-732FFC3DD517}\.cr\python-3.12.2-amd64.exe
    "C:\Windows\Temp\{89DE4649-7562-40F2-95BD-732FFC3DD517}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=692
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,15549498091417753096,7873287861019661947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:5364
- C:\Users\Admin\Downloads\python-3.12.2-amd64 (1).exe
  "C:\Users\Admin\Downloads\python-3.12.2-amd64 (1).exe"
  2⤵
  - Executes dropped EXE
  PID:5096
- - C:\Windows\Temp\{AE1D3F5D-4996-48F4-995D-E2FDD05A7D81}\.cr\python-3.12.2-amd64 (1).exe
    "C:\Windows\Temp\{AE1D3F5D-4996-48F4-995D-E2FDD05A7D81}\.cr\python-3.12.2-amd64 (1).exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64 (1).exe" -burn.filehandle.attached=568 -burn.filehandle.self=720
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    PID:5804
- C:\Users\Admin\Downloads\python-3.12.2-amd64 (1).exe
  "C:\Users\Admin\Downloads\python-3.12.2-amd64 (1).exe"
  2⤵
  - Executes dropped EXE
  PID:4328
- - C:\Windows\Temp\{371630A0-6DE0-40B6-9762-59BEE90C2B3C}\.cr\python-3.12.2-amd64 (1).exe
    "C:\Windows\Temp\{371630A0-6DE0-40B6-9762-59BEE90C2B3C}\.cr\python-3.12.2-amd64 (1).exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64 (1).exe" -burn.filehandle.attached=540 -burn.filehandle.self=692
    3⤵
    - Executes dropped EXE
    PID:6084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4356
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7zO42A7D63D\Backdoor.ASP.Ace.a
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:832
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3992
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:17414 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    PID:1352
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:82960 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    PID:2756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4024

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\viruses-20060327.tar\" -ad -an -ai#7zMap10869:102:7zEvent32207
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\viruses-20060327.tar\viruses-20060327.tar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1052
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOC1498BBF\list.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5092
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw
  2⤵
  - Modifies Internet Explorer settings
  PID:220
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:220 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    PID:2996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2160
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-main.zip\Luna-Grabber-main\README.md
  2⤵
  PID:4616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_Luna-Grabber-main.zip\Luna-Grabber-main\setup.bat" "
1⤵
PID:3584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B38C7355392CDE2F18ED729BD397B7AF
  2⤵
  - Loads dropped DLL
  PID:3512
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4848
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpyhklqrpj\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpyhklqrpj', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ACB8605C784C31F498BE3C379902C2DB
  2⤵
  PID:1520
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -B -m ensurepip._uninstall
    3⤵
    - Executes dropped EXE
    PID:5080
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = [] + sys.path sys.argv[1:] = ['uninstall', '-y', '--disable-pip-version-check', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      PID:1048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 685ACD2735151AA7F14CA890D23B802D
  2⤵
  PID:208
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    PID:1768
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpoxr_kkia\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpoxr_kkia', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      PID:2936

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
1⤵
- Executes dropped EXE
PID:1752
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2024

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
1⤵
- Executes dropped EXE
PID:900
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\setup.bat" "
1⤵
PID:5272

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
1⤵
- Executes dropped EXE
PID:5432
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4168

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
1⤵
- Executes dropped EXE
PID:5916
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5480

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\luna.py"
1⤵
- Executes dropped EXE
PID:5804
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\luna.py"
  2⤵
  - Executes dropped EXE
  PID:6128

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
1⤵
- Executes dropped EXE
PID:4556
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
  2⤵
  - Executes dropped EXE
  PID:5060

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\luna.py"
1⤵
- Executes dropped EXE
PID:2580
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\luna.py"
  2⤵
  - Executes dropped EXE
  PID:2644

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:3536

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\luna.py"
1⤵
- Executes dropped EXE
PID:5128
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\luna.py"
  2⤵
  - Executes dropped EXE
  PID:5188

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\pyw.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
1⤵
- Executes dropped EXE
PID:5524
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\builder.pyw"
  2⤵
  - Executes dropped EXE
  PID:4160

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\tools\update.py"
1⤵
- Executes dropped EXE
PID:3188
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\tools\update.py"
  2⤵
  - Executes dropped EXE
  PID:5372

C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Launcher\py.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\tools\upx.py"
1⤵
- Executes dropped EXE
PID:4948
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\tools\upx.py"
  2⤵
  - Executes dropped EXE
  PID:2472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp2_Luna-Grabber-main.zip\Luna-Grabber-main\setup.bat" "
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery