xworm | 8641f88b89c9076ece3ee571baa4b3c93ba3ac3883e90fe5f894dc41e3b7bdc7

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	loader-upd.exe

Executes dropped EXE 3 IoCs

pid	Process
1888	svchost.exe
3124	svchost.exe
5728	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Public\\svchost.exe"	loader-upd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
194	7.tcp.eu.ngrok.io
29	pastebin.com
30	pastebin.com
32	7.tcp.eu.ngrok.io
92	7.tcp.eu.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
1952	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355664440-2199602304-1223909400-1000\{6D386245-C4C3-4324-84C2-2D5BBB411DF0}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4180	loader-upd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
912	powershell.exe
912	powershell.exe
4112	powershell.exe
4112	powershell.exe
1584	powershell.exe
1584	powershell.exe
3244	powershell.exe
3244	powershell.exe
4180	loader-upd.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
464	msedge.exe
464	msedge.exe
3224	taskmgr.exe
3224	taskmgr.exe
2272	msedge.exe
2272	msedge.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
2560	msedge.exe
2560	msedge.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
2520	identity_helper.exe
2520	identity_helper.exe
3224	taskmgr.exe
3224	taskmgr.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
3224	taskmgr.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe
3224	taskmgr.exe
4180	loader-upd.exe
4180	loader-upd.exe
4180	loader-upd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	loader-upd.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	4180	loader-upd.exe
Token: SeDebugPrivilege	1888	svchost.exe
Token: SeDebugPrivilege	3224	taskmgr.exe
Token: SeSystemProfilePrivilege	3224	taskmgr.exe
Token: SeCreateGlobalPrivilege	3224	taskmgr.exe
Token: SeDebugPrivilege	3124	svchost.exe
Token: SeDebugPrivilege	5728	svchost.exe
Token: 33	5896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5896	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe
3224	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4180	loader-upd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 912	4180	loader-upd.exe	90
PID 4180 wrote to memory of 912	4180	loader-upd.exe	90
PID 4180 wrote to memory of 4112	4180	loader-upd.exe	92
PID 4180 wrote to memory of 4112	4180	loader-upd.exe	92
PID 4180 wrote to memory of 1584	4180	loader-upd.exe	94
PID 4180 wrote to memory of 1584	4180	loader-upd.exe	94
PID 4180 wrote to memory of 3244	4180	loader-upd.exe	96
PID 4180 wrote to memory of 3244	4180	loader-upd.exe	96
PID 4180 wrote to memory of 1952	4180	loader-upd.exe	98
PID 4180 wrote to memory of 1952	4180	loader-upd.exe	98
PID 2272 wrote to memory of 4248	2272	msedge.exe	108
PID 2272 wrote to memory of 4248	2272	msedge.exe	108
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 3268	2272	msedge.exe	109
PID 2272 wrote to memory of 464	2272	msedge.exe	110
PID 2272 wrote to memory of 464	2272	msedge.exe	110
PID 2272 wrote to memory of 2316	2272	msedge.exe	111
PID 2272 wrote to memory of 2316	2272	msedge.exe	111
PID 2272 wrote to memory of 2316	2272	msedge.exe	111
PID 2272 wrote to memory of 2316	2272	msedge.exe	111
PID 2272 wrote to memory of 2316	2272	msedge.exe	111
PID 2272 wrote to memory of 2316	2272	msedge.exe	111
PID 2272 wrote to memory of 2316	2272	msedge.exe	111
PID 2272 wrote to memory of 2316	2272	msedge.exe	111
PID 2272 wrote to memory of 2316	2272	msedge.exe	111
PID 2272 wrote to memory of 2316	2272	msedge.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Ro-exec\loader-upd.exe
"C:\Users\Admin\AppData\Local\Temp\Ro-exec\loader-upd.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Ro-exec\loader-upd.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'loader-upd.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\svchost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1952

C:\Users\Public\svchost.exe
C:\Users\Public\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=ujkzdo.exe ujkzdo.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x104,0x130,0x7ff8b36f46f8,0x7ff8b36f4708,0x7ff8b36f4718
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2875722608434152888,6363957428662301108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

C:\Users\Public\svchost.exe
C:\Users\Public\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Users\Public\svchost.exe
C:\Users\Public\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x3ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery