asyncrat | hxxps://www[.]upload[.]ee/files/16345733/Setup[.]exe[.]html

System Information Discovery

Processes:

Stub.exeWindows Update.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Stub.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Windows Update.exe

Drops startup file 2 IoCs

Processes:

Windows Update.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update.lnk	Windows Update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update.lnk	Windows Update.exe

Executes dropped EXE 33 IoCs

Processes:

Stub.exeWindows Update.exesvchost.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeAll-In-One.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exe

pid	Process
6116	Stub.exe
2212	Windows Update.exe
6008	svchost.exe
4836	Windows Update.exe
5132	Windows Update.exe
5292	Windows Update.exe
3248	Windows Update.exe
4176	Windows Update.exe
4188	Windows Update.exe
876	All-In-One.exe
1684	Windows Update.exe
3108	Windows Update.exe
5736	Windows Update.exe
4128	Windows Update.exe
4704	Windows Update.exe
5024	Windows Update.exe
2268	Windows Update.exe
5300	Windows Update.exe
5472	Windows Update.exe
3860	Windows Update.exe
3236	Windows Update.exe
6028	Windows Update.exe
5708	Windows Update.exe
1416	Windows Update.exe
712	Windows Update.exe
3076	Windows Update.exe
3544	Windows Update.exe
5624	Windows Update.exe
2092	Windows Update.exe
2908	Windows Update.exe
2268	Windows Update.exe
3204	Windows Update.exe
4452	Windows Update.exe

Loads dropped DLL 1 IoCs

Processes:

All-In-One.exe

pid	Process
876	All-In-One.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x00070000000232d4-187.dat	upx
behavioral1/files/0x00070000000232d7-202.dat	upx
behavioral1/files/0x00070000000232d6-197.dat	upx
behavioral1/files/0x00070000000232d5-192.dat	upx
behavioral1/files/0x000a0000000232d3-180.dat	upx

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

All-In-One.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	All-In-One.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Windows Update.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\ProgramData\\Windows Update.exe"	Windows Update.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
300	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exetaskmgr.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

schtasks.exeschtasks.exe

pid	Process
3888	schtasks.exe
560	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
5792	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 7 IoCs

Processes:

taskmgr.exemsedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{75A62D36-2961-4A7B-9633-1965F85507B9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	taskmgr.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Windows Update.exe

pid	Process
2212	Windows Update.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Stub.exepowershell.exepowershell.exepowershell.exeWindows Update.exetaskmgr.exe

pid	Process
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
6116	Stub.exe
5176	powershell.exe
5176	powershell.exe
5176	powershell.exe
5956	powershell.exe
5956	powershell.exe
5956	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
2212	Windows Update.exe
2212	Windows Update.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid	Process
4860	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid	Process
5356	msedge.exe
5356	msedge.exe
5356	msedge.exe
5356	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

Windows Update.exeStub.exepowershell.exepowershell.exepowershell.exesvchost.exeWindows Update.exetaskmgr.exeWindows Update.exeWindows Update.exeWindows Update.exetaskmgr.exeWindows Update.exeWindows Update.exeAll-In-One.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exeWindows Update.exe

description	pid	Process
Token: SeDebugPrivilege	2212	Windows Update.exe
Token: SeDebugPrivilege	6116	Stub.exe
Token: SeDebugPrivilege	6116	Stub.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeDebugPrivilege	5956	powershell.exe
Token: SeDebugPrivilege	5520	powershell.exe
Token: SeDebugPrivilege	6008	svchost.exe
Token: SeDebugPrivilege	6008	svchost.exe
Token: SeDebugPrivilege	2212	Windows Update.exe
Token: SeDebugPrivilege	4836	Windows Update.exe
Token: SeDebugPrivilege	2616	taskmgr.exe
Token: SeSystemProfilePrivilege	2616	taskmgr.exe
Token: SeCreateGlobalPrivilege	2616	taskmgr.exe
Token: SeDebugPrivilege	5132	Windows Update.exe
Token: SeDebugPrivilege	5292	Windows Update.exe
Token: 33	2616	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2616	taskmgr.exe
Token: SeDebugPrivilege	3248	Windows Update.exe
Token: SeDebugPrivilege	4860	taskmgr.exe
Token: SeSystemProfilePrivilege	4860	taskmgr.exe
Token: SeCreateGlobalPrivilege	4860	taskmgr.exe
Token: SeDebugPrivilege	4176	Windows Update.exe
Token: SeDebugPrivilege	4188	Windows Update.exe
Token: 33	4860	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4860	taskmgr.exe
Token: SeDebugPrivilege	876	All-In-One.exe
Token: SeDebugPrivilege	1684	Windows Update.exe
Token: SeDebugPrivilege	3108	Windows Update.exe
Token: SeDebugPrivilege	5736	Windows Update.exe
Token: SeDebugPrivilege	4128	Windows Update.exe
Token: SeDebugPrivilege	4704	Windows Update.exe
Token: SeDebugPrivilege	5024	Windows Update.exe
Token: SeDebugPrivilege	2268	Windows Update.exe
Token: SeDebugPrivilege	5300	Windows Update.exe
Token: SeDebugPrivilege	5472	Windows Update.exe
Token: SeDebugPrivilege	3860	Windows Update.exe
Token: SeDebugPrivilege	3236	Windows Update.exe
Token: SeDebugPrivilege	6028	Windows Update.exe
Token: SeDebugPrivilege	5708	Windows Update.exe
Token: SeDebugPrivilege	1416	Windows Update.exe
Token: SeDebugPrivilege	712	Windows Update.exe
Token: SeDebugPrivilege	3076	Windows Update.exe
Token: SeDebugPrivilege	3544	Windows Update.exe
Token: SeDebugPrivilege	5624	Windows Update.exe
Token: SeDebugPrivilege	2092	Windows Update.exe
Token: SeDebugPrivilege	2908	Windows Update.exe
Token: SeDebugPrivilege	2268	Windows Update.exe
Token: SeDebugPrivilege	3204	Windows Update.exe
Token: SeDebugPrivilege	4452	Windows Update.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	Process
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	Process
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe
2616	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Windows Update.exeAll-In-One.exe

pid	Process
2212	Windows Update.exe
876	All-In-One.exe
876	All-In-One.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup.exeStub.execmd.execmd.exeWindows Update.execmd.exemsedge.exe

description	pid	Process	procid_target
PID 220 wrote to memory of 6116	220	Setup.exe	125
PID 220 wrote to memory of 6116	220	Setup.exe	125
PID 220 wrote to memory of 2212	220	Setup.exe	126
PID 220 wrote to memory of 2212	220	Setup.exe	126
PID 6116 wrote to memory of 1416	6116	Stub.exe	128
PID 6116 wrote to memory of 1416	6116	Stub.exe	128
PID 6116 wrote to memory of 496	6116	Stub.exe	130
PID 6116 wrote to memory of 496	6116	Stub.exe	130
PID 496 wrote to memory of 5792	496	cmd.exe	133
PID 496 wrote to memory of 5792	496	cmd.exe	133
PID 1416 wrote to memory of 3888	1416	cmd.exe	132
PID 1416 wrote to memory of 3888	1416	cmd.exe	132
PID 2212 wrote to memory of 5176	2212	Windows Update.exe	134
PID 2212 wrote to memory of 5176	2212	Windows Update.exe	134
PID 2212 wrote to memory of 5956	2212	Windows Update.exe	136
PID 2212 wrote to memory of 5956	2212	Windows Update.exe	136
PID 496 wrote to memory of 6008	496	cmd.exe	138
PID 496 wrote to memory of 6008	496	cmd.exe	138
PID 2212 wrote to memory of 5520	2212	Windows Update.exe	139
PID 2212 wrote to memory of 5520	2212	Windows Update.exe	139
PID 2212 wrote to memory of 560	2212	Windows Update.exe	141
PID 2212 wrote to memory of 560	2212	Windows Update.exe	141
PID 2212 wrote to memory of 4680	2212	Windows Update.exe	152
PID 2212 wrote to memory of 4680	2212	Windows Update.exe	152
PID 4680 wrote to memory of 876	4680	cmd.exe	154
PID 4680 wrote to memory of 876	4680	cmd.exe	154
PID 4680 wrote to memory of 876	4680	cmd.exe	154
PID 5356 wrote to memory of 5984	5356	msedge.exe	165
PID 5356 wrote to memory of 5984	5356	msedge.exe	165
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167
PID 5356 wrote to memory of 1240	5356	msedge.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.upload.ee/files/16345733/Setup.exe.html
1⤵
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3892 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5384 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=4516 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5840 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5980 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=5824 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:5952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6392 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=6516 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=6668 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --mojo-platform-channel-handle=6792 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --mojo-platform-channel-handle=7012 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=5708 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --mojo-platform-channel-handle=6496 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --mojo-platform-channel-handle=7460 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6272 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --mojo-platform-channel-handle=5436 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7884 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=7928 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5628

C:\Users\Admin\Downloads\Setup.exe
"C:\Users\Admin\Downloads\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Temp\Stub.exe
  "C:\Users\Admin\AppData\Local\Temp\Stub.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
      4⤵
      Creates scheduled task(s)
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCAAE.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:496
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5792
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:6008
- C:\Users\Admin\AppData\Local\Temp\Windows Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows Update.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Windows Update.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Update.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows Update.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5520
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Update" /tr "C:\ProgramData\Windows Update.exe"
    3⤵
    - Creates scheduled task(s)
    PID:560
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
      All-In-One.exe OutPut.json
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Accesses Microsoft Outlook accounts
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6120 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=7596 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:2296

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2616

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3536

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5292

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1388 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5228

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --mojo-platform-channel-handle=1644 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --mojo-platform-channel-handle=4900 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:5296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --mojo-platform-channel-handle=1388 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --mojo-platform-channel-handle=3672 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --mojo-platform-channel-handle=1716 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --mojo-platform-channel-handle=6780 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:1
1⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd7c282e98,0x7ffd7c282ea4,0x7ffd7c282eb0
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3032 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3176 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3184 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4540 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=4816 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4860 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5312 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5340 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5296 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4400 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3936 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3876 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3916 --field-trial-handle=3036,i,12464801368392278857,6339498030100271002,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5692

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5300

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5472

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5708

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5624

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\ProgramData\Windows Update.exe
"C:\ProgramData\Windows Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery