a9272268e017eced810788b465dd4ce90e4b58e9500a84b382956146b3ff07d3

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
2872	takeown.exe
1268	icacls.exe
3968	takeown.exe
3064	icacls.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 2 IoCs

pid	Process
1544	setup.exe
1780	setup.exe

Loads dropped DLL 4 IoCs

pid	Process
452	Remove-EdgeOnly.exe
452	Remove-EdgeOnly.exe
452	Remove-EdgeOnly.exe
452	Remove-EdgeOnly.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2872	takeown.exe
1268	icacls.exe
3968	takeown.exe
3064	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LOCALSERVER32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	setup.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris	cmd.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3632	sc.exe
3128	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe

Modifies registry class 56 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEHTM\APPLICATION	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\runas	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INTERFACE\{C9C2B807-7731-4F34-81B7-44FF7779522B}\PROXYSTUBCLSID32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open\command	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEPDF\DEFAULTICON	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open\command	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FCBE96C-1697-43AF-9140-2897C7C69767}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INTERFACE\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TYPELIB	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ie_to_edge_bho.dll	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1\CLSID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\TYPELIB\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\WIN32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEHTM\SHELL\RUNAS\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEPDF\SHELL\RUNAS\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LOCALSERVER32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1FCBE96C-1697-43AF-9140-2897C7C69767}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEPDF\SHELL\OPEN\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{31575964-95F7-414B-85E4-0E9A93699E13}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\CurVer	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\TYPELIB\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\WIN64	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEHTM\DEFAULTICON	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEPDF\APPLICATION	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\CLSID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\runas	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge	setup.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
4540	reg.exe
4704	reg.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1544	setup.exe
1544	setup.exe
1544	setup.exe
1544	setup.exe
1544	setup.exe
1544	setup.exe
1544	setup.exe
1544	setup.exe
4156	powershell.exe
4156	powershell.exe
416	powershell.exe
416	powershell.exe
3428	powershell.exe
3428	powershell.exe
1156	powershell.exe
1156	powershell.exe
3572	powershell.exe
3572	powershell.exe
3572	powershell.exe
2592	powershell.exe
2592	powershell.exe
1784	powershell.exe
1784	powershell.exe
684	powershell.exe
684	powershell.exe
684	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeBackupPrivilege	1544	setup.exe
Token: SeRestorePrivilege	1544	setup.exe
Token: SeDebugPrivilege	416	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeManageVolumePrivilege	2596	svchost.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeTakeOwnershipPrivilege	2872	takeown.exe
Token: SeTakeOwnershipPrivilege	3968	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 452	2664	Remove-EdgeOnly.exe	94
PID 2664 wrote to memory of 452	2664	Remove-EdgeOnly.exe	94
PID 2664 wrote to memory of 452	2664	Remove-EdgeOnly.exe	94
PID 452 wrote to memory of 1544	452	Remove-EdgeOnly.exe	96
PID 452 wrote to memory of 1544	452	Remove-EdgeOnly.exe	96
PID 1544 wrote to memory of 1780	1544	setup.exe	97
PID 1544 wrote to memory of 1780	1544	setup.exe	97
PID 452 wrote to memory of 4156	452	Remove-EdgeOnly.exe	98
PID 452 wrote to memory of 4156	452	Remove-EdgeOnly.exe	98
PID 452 wrote to memory of 4156	452	Remove-EdgeOnly.exe	98
PID 1544 wrote to memory of 1504	1544	setup.exe	99
PID 1544 wrote to memory of 1504	1544	setup.exe	99
PID 452 wrote to memory of 416	452	Remove-EdgeOnly.exe	102
PID 452 wrote to memory of 416	452	Remove-EdgeOnly.exe	102
PID 452 wrote to memory of 416	452	Remove-EdgeOnly.exe	102
PID 452 wrote to memory of 3428	452	Remove-EdgeOnly.exe	107
PID 452 wrote to memory of 3428	452	Remove-EdgeOnly.exe	107
PID 452 wrote to memory of 3428	452	Remove-EdgeOnly.exe	107
PID 452 wrote to memory of 1156	452	Remove-EdgeOnly.exe	109
PID 452 wrote to memory of 1156	452	Remove-EdgeOnly.exe	109
PID 452 wrote to memory of 1156	452	Remove-EdgeOnly.exe	109
PID 452 wrote to memory of 3572	452	Remove-EdgeOnly.exe	112
PID 452 wrote to memory of 3572	452	Remove-EdgeOnly.exe	112
PID 452 wrote to memory of 3572	452	Remove-EdgeOnly.exe	112
PID 452 wrote to memory of 2592	452	Remove-EdgeOnly.exe	113
PID 452 wrote to memory of 2592	452	Remove-EdgeOnly.exe	113
PID 452 wrote to memory of 2592	452	Remove-EdgeOnly.exe	113
PID 452 wrote to memory of 1784	452	Remove-EdgeOnly.exe	115
PID 452 wrote to memory of 1784	452	Remove-EdgeOnly.exe	115
PID 452 wrote to memory of 1784	452	Remove-EdgeOnly.exe	115
PID 452 wrote to memory of 684	452	Remove-EdgeOnly.exe	120
PID 452 wrote to memory of 684	452	Remove-EdgeOnly.exe	120
PID 452 wrote to memory of 684	452	Remove-EdgeOnly.exe	120
PID 452 wrote to memory of 2288	452	Remove-EdgeOnly.exe	121
PID 452 wrote to memory of 2288	452	Remove-EdgeOnly.exe	121
PID 452 wrote to memory of 2288	452	Remove-EdgeOnly.exe	121
PID 452 wrote to memory of 4428	452	Remove-EdgeOnly.exe	122
PID 452 wrote to memory of 4428	452	Remove-EdgeOnly.exe	122
PID 452 wrote to memory of 4428	452	Remove-EdgeOnly.exe	122
PID 452 wrote to memory of 3848	452	Remove-EdgeOnly.exe	123
PID 452 wrote to memory of 3848	452	Remove-EdgeOnly.exe	123
PID 452 wrote to memory of 3848	452	Remove-EdgeOnly.exe	123
PID 452 wrote to memory of 3632	452	Remove-EdgeOnly.exe	124
PID 452 wrote to memory of 3632	452	Remove-EdgeOnly.exe	124
PID 452 wrote to memory of 3632	452	Remove-EdgeOnly.exe	124
PID 452 wrote to memory of 3128	452	Remove-EdgeOnly.exe	125
PID 452 wrote to memory of 3128	452	Remove-EdgeOnly.exe	125
PID 452 wrote to memory of 3128	452	Remove-EdgeOnly.exe	125
PID 452 wrote to memory of 4540	452	Remove-EdgeOnly.exe	126
PID 452 wrote to memory of 4540	452	Remove-EdgeOnly.exe	126
PID 452 wrote to memory of 4540	452	Remove-EdgeOnly.exe	126
PID 452 wrote to memory of 4704	452	Remove-EdgeOnly.exe	127
PID 452 wrote to memory of 4704	452	Remove-EdgeOnly.exe	127
PID 452 wrote to memory of 4704	452	Remove-EdgeOnly.exe	127
PID 452 wrote to memory of 3232	452	Remove-EdgeOnly.exe	128
PID 452 wrote to memory of 3232	452	Remove-EdgeOnly.exe	128
PID 452 wrote to memory of 3232	452	Remove-EdgeOnly.exe	128
PID 3232 wrote to memory of 2872	3232	cmd.exe	129
PID 3232 wrote to memory of 2872	3232	cmd.exe	129
PID 3232 wrote to memory of 2872	3232	cmd.exe	129
PID 3232 wrote to memory of 1268	3232	cmd.exe	130
PID 3232 wrote to memory of 1268	3232	cmd.exe	130
PID 3232 wrote to memory of 1268	3232	cmd.exe	130
PID 452 wrote to memory of 1032	452	Remove-EdgeOnly.exe	131

C:\Users\Admin\AppData\Local\Temp\Remove-EdgeOnly.exe
"C:\Users\Admin\AppData\Local\Temp\Remove-EdgeOnly.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Local\Temp\Remove-EdgeOnly.exe
  "C:\Users\Admin\AppData\Local\Temp\Remove-EdgeOnly.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Users\Admin\AppData\Local\Temp\_MEI26642\setup.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI26642\setup.exe --uninstall --system-level --force-uninstall
    3⤵
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Executes dropped EXE
    - Registers COM server for autorun
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\_MEI26642\setup.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI26642\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\_MEI26642\setup.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x21c,0x220,0x224,0x1f4,0x228,0x7ff7e4e1eb10,0x7ff7e4e1eb20,0x7ff7e4e1eb30
      4⤵
      Executes dropped EXE
      PID:1780
  - - C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1544" "1752" "1684" "1756" "0" "0" "0" "0" "0" "0" "0" "0"
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      PID:1504
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell "(New-Object System.Security.Principal.NTAccount($env:USERNAME)).Translate([System.Security.Principal.SecurityIdentifier]).Value"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-AppxPackage -AllUsers | Where-Object {$_.PackageFullName -like \"*microsoftedge*\"} | Select-Object -ExpandProperty PackageFullName"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Remove-AppxPackage -Package Microsoft.MicrosoftEdgeDevToolsClient_1000.19041.1023.0_neutral_neutral_8wekyb3d8bbwe 2>$null"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Remove-AppxPackage -Package Microsoft.MicrosoftEdgeDevToolsClient_1000.19041.1023.0_neutral_neutral_8wekyb3d8bbwe -AllUsers 2>$null"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Remove-AppxPackage -Package Microsoft.MicrosoftEdge_44.19041.1266.0_neutral__8wekyb3d8bbwe 2>$null"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Remove-AppxPackage -Package Microsoft.MicrosoftEdge_44.19041.1266.0_neutral__8wekyb3d8bbwe -AllUsers 2>$null"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Remove-AppxPackage -Package Microsoft.MicrosoftEdge.Stable_122.0.2365.52_neutral__8wekyb3d8bbwe 2>$null"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1784
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Remove-AppxPackage -Package Microsoft.MicrosoftEdge.Stable_122.0.2365.52_neutral__8wekyb3d8bbwe -AllUsers 2>$null"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /q /s "C:\ProgramData\Microsoft\EdgeUpdate""
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}" /f
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /query /fo csv
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\sc.exe
    sc delete edgeupdate
    3⤵
    - Launches sc.exe
    PID:3632
- - C:\Windows\SysWOW64\sc.exe
    sc delete edgeupdatem
    3⤵
    - Launches sc.exe
    PID:3128
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate /f
    3⤵
    - Modifies registry key
    PID:4540
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\SOFTWARE\WOW6432Node\Microsoft\Edge /f
    3⤵
    - Modifies registry key
    PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe" /r /d y && icacls "C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe" /grant administrators:F /t && rd /s /q "C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe""
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f "C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:2872
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe" /grant administrators:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe" /r /d y && icacls "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe" /grant administrators:F /t && rd /s /q "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe""
    3⤵
    PID:1032
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:3968
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe" /grant administrators:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /q /s "C:\Program Files (x86)\Microsoft\Temp""
    3⤵
    PID:400

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe
1⤵
PID:3680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery