dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CiscoCollabHost.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	CiscoCollabHost.exe

Executes dropped EXE 17 IoCs

pid	Process
784	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
3052	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
4620	MicrosoftEdgeUpdate.exe
1168	MicrosoftEdgeUpdate.exe
1292	MicrosoftEdgeUpdate.exe
3576	MicrosoftEdgeUpdateComRegisterShell64.exe
2448	MicrosoftEdgeUpdateComRegisterShell64.exe
3032	MicrosoftEdgeUpdateComRegisterShell64.exe
2508	MicrosoftEdgeUpdate.exe
4224	MicrosoftEdgeUpdate.exe
4828	MicrosoftEdgeUpdate.exe
2208	MicrosoftEdgeUpdate.exe
2360	MicrosoftEdgeUpdate.exe
1408	MicrosoftEdgeWebview_X64_118.0.2088.69.exe
3940	setup.exe
2224	MicrosoftEdgeUpdate.exe

Loads dropped DLL 64 IoCs

pid	Process
3984	MsiExec.exe
3984	MsiExec.exe
784	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe

Registers COM server for autorun 1 TTPs 33 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/212-0-0x0000000000E80000-0x00000000012E3000-memory.dmp	upx
behavioral2/memory/212-155-0x0000000000E80000-0x00000000012E3000-memory.dmp	upx
behavioral2/memory/212-200-0x0000000000E80000-0x00000000012E3000-memory.dmp	upx
behavioral2/memory/212-261-0x0000000000E80000-0x00000000012E3000-memory.dmp	upx
behavioral2/memory/212-800-0x0000000000E80000-0x00000000012E3000-memory.dmp	upx
behavioral2/memory/212-1192-0x0000000000E80000-0x00000000012E3000-memory.dmp	upx
behavioral2/memory/212-1195-0x0000000000E80000-0x00000000012E3000-memory.dmp	upx

Blocklisted process makes network request 3 IoCs

flow	pid	Process
27	2724	msiexec.exe
28	2724	msiexec.exe
36	2724	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_vi.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_tt.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\VisualElements\LogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.69\Locales\ml.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\EdgeWebView.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Trust Protection Lists\Mu\Advertising	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\OfflineManifest.gup	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Locales\bs.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\MEIPreload\preloaded_data.pb	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Trust Protection Lists\Sigma\LICENSE	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.69\Locales\hi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\identity_proxy\win11\identity_helper.Sparse.Stable.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\oneds.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\d3dcompiler_47.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.69\Locales\mi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Locales\gl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\microsoft_shell_integration.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\nacl_irt_x86_64.nexe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.69\identity_proxy\win10\identity_helper.Sparse.Dev.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\msedgewebview2.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Trust Protection Lists\Mu\CompatExceptions	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\msedgewebview2.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.69\Locales\es.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\identity_proxy\canary.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Locales\kk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\msedge_elf.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\v8_context_snapshot.bin	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.69\Trust Protection Lists\Sigma\LICENSE	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_eu.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Notifications\SoftLandingAssetLight.gif	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Installer\msedge_7z.data	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.69\identity_proxy\win11\identity_helper.Sparse.Stable.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_pt-PT.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_te.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.69\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.69\Locales\mr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Trust Protection Lists\Sigma\Social	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\msvcp140_codecvt_ids.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Locales\kn.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\identity_proxy\win11\identity_helper.Sparse.Stable.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_fr.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_gu.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_it.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\msvcp140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\cookie_exporter.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\identity_proxy\stable.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\BHO\ie_to_edge_bho.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Trust Protection Lists\Sigma\Staging	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Locales\en-US.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.69\Locales\pl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_et.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_bn-IN.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Locales\ko.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\msedge_100_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Locales\ca-Es-VALENCIA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Locales\es-419.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\Locales\sq.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\identity_proxy\resources.pri	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_pa.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\msedgeupdateres_ug.dll	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.69\elevation_service.exe	setup.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIEB98.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e57e5a1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC07.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4A82B9CC-F7B3-5000-9CA4-89764C5A9DA4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED9E.tmp	msiexec.exe
File created	C:\Windows\Installer\e57e59d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e59d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
972	timeout.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	CiscoCollabHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	CiscoCollabHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	CiscoCollabHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	CiscoCollabHost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4112	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\webex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\webex\	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\webex\WarnOnOpen = "0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ED55221F-CF41-4829-9DED-8312B04F88DE}\AppName = "CiscoCollabHost.exe"	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ED55221F-CF41-4829-9DED-8312B04F88DE}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Cisco Spark\\"	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ED55221F-CF41-4829-9DED-8312B04F88DE}\Policy = "3"	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\webex	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\webex\WarnOnOpen = "0"	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ED55221F-CF41-4829-9DED-8312B04F88DE}	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8EDF453E-CD8F-4C56-BBA1-AA63266058E5}\InprocHandler32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{F795C339-932E-4B24-85B3-C7865BE4C1B9}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32\ = "{F795C339-932E-4B24-85B3-C7865BE4C1B9}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer\ = "MicrosoftEdgeUpdate.CoreClass.1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{F795C339-932E-4B24-85B3-C7865BE4C1B9}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdate.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4904	CiscoCollabHost.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2724	msiexec.exe
2724	msiexec.exe
4904	CiscoCollabHost.exe
4620	MicrosoftEdgeUpdate.exe
4620	MicrosoftEdgeUpdate.exe
4620	MicrosoftEdgeUpdate.exe
4620	MicrosoftEdgeUpdate.exe
4620	MicrosoftEdgeUpdate.exe
4620	MicrosoftEdgeUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4904	CiscoCollabHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4616	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4616	msiexec.exe
Token: SeSecurityPrivilege	2724	msiexec.exe
Token: SeCreateTokenPrivilege	4616	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4616	msiexec.exe
Token: SeLockMemoryPrivilege	4616	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4616	msiexec.exe
Token: SeMachineAccountPrivilege	4616	msiexec.exe
Token: SeTcbPrivilege	4616	msiexec.exe
Token: SeSecurityPrivilege	4616	msiexec.exe
Token: SeTakeOwnershipPrivilege	4616	msiexec.exe
Token: SeLoadDriverPrivilege	4616	msiexec.exe
Token: SeSystemProfilePrivilege	4616	msiexec.exe
Token: SeSystemtimePrivilege	4616	msiexec.exe
Token: SeProfSingleProcessPrivilege	4616	msiexec.exe
Token: SeIncBasePriorityPrivilege	4616	msiexec.exe
Token: SeCreatePagefilePrivilege	4616	msiexec.exe
Token: SeCreatePermanentPrivilege	4616	msiexec.exe
Token: SeBackupPrivilege	4616	msiexec.exe
Token: SeRestorePrivilege	4616	msiexec.exe
Token: SeShutdownPrivilege	4616	msiexec.exe
Token: SeDebugPrivilege	4616	msiexec.exe
Token: SeAuditPrivilege	4616	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4616	msiexec.exe
Token: SeChangeNotifyPrivilege	4616	msiexec.exe
Token: SeRemoteShutdownPrivilege	4616	msiexec.exe
Token: SeUndockPrivilege	4616	msiexec.exe
Token: SeSyncAgentPrivilege	4616	msiexec.exe
Token: SeEnableDelegationPrivilege	4616	msiexec.exe
Token: SeManageVolumePrivilege	4616	msiexec.exe
Token: SeImpersonatePrivilege	4616	msiexec.exe
Token: SeCreateGlobalPrivilege	4616	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeDebugPrivilege	4112	taskkill.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe
Token: SeTakeOwnershipPrivilege	2724	msiexec.exe
Token: SeRestorePrivilege	2724	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4904	CiscoCollabHost.exe
4904	CiscoCollabHost.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4616	212	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe	93
PID 212 wrote to memory of 4616	212	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe	93
PID 212 wrote to memory of 4616	212	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe	93
PID 2724 wrote to memory of 3984	2724	msiexec.exe	103
PID 2724 wrote to memory of 3984	2724	msiexec.exe	103
PID 2724 wrote to memory of 3984	2724	msiexec.exe	103
PID 3984 wrote to memory of 4112	3984	MsiExec.exe	104
PID 3984 wrote to memory of 4112	3984	MsiExec.exe	104
PID 3984 wrote to memory of 4112	3984	MsiExec.exe	104
PID 2724 wrote to memory of 1388	2724	msiexec.exe	106
PID 2724 wrote to memory of 1388	2724	msiexec.exe	106
PID 212 wrote to memory of 2796	212	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe	114
PID 212 wrote to memory of 2796	212	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe	114
PID 212 wrote to memory of 2796	212	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe	114
PID 2796 wrote to memory of 972	2796	cmd.exe	116
PID 2796 wrote to memory of 972	2796	cmd.exe	116
PID 2796 wrote to memory of 972	2796	cmd.exe	116
PID 212 wrote to memory of 784	212	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe	117
PID 212 wrote to memory of 784	212	dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe	117
PID 784 wrote to memory of 4904	784	CiscoCollabHost.exe	118
PID 784 wrote to memory of 4904	784	CiscoCollabHost.exe	118
PID 4904 wrote to memory of 4652	4904	CiscoCollabHost.exe	119
PID 4904 wrote to memory of 4652	4904	CiscoCollabHost.exe	119
PID 4652 wrote to memory of 3052	4652	cmd.exe	121
PID 4652 wrote to memory of 3052	4652	cmd.exe	121
PID 4652 wrote to memory of 3052	4652	cmd.exe	121
PID 3052 wrote to memory of 4620	3052	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe	123
PID 3052 wrote to memory of 4620	3052	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe	123
PID 3052 wrote to memory of 4620	3052	MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe	123
PID 4620 wrote to memory of 1168	4620	MicrosoftEdgeUpdate.exe	124
PID 4620 wrote to memory of 1168	4620	MicrosoftEdgeUpdate.exe	124
PID 4620 wrote to memory of 1168	4620	MicrosoftEdgeUpdate.exe	124
PID 4620 wrote to memory of 1292	4620	MicrosoftEdgeUpdate.exe	125
PID 4620 wrote to memory of 1292	4620	MicrosoftEdgeUpdate.exe	125
PID 4620 wrote to memory of 1292	4620	MicrosoftEdgeUpdate.exe	125
PID 1292 wrote to memory of 3576	1292	MicrosoftEdgeUpdate.exe	126
PID 1292 wrote to memory of 3576	1292	MicrosoftEdgeUpdate.exe	126
PID 1292 wrote to memory of 2448	1292	MicrosoftEdgeUpdate.exe	127
PID 1292 wrote to memory of 2448	1292	MicrosoftEdgeUpdate.exe	127
PID 1292 wrote to memory of 3032	1292	MicrosoftEdgeUpdate.exe	128
PID 1292 wrote to memory of 3032	1292	MicrosoftEdgeUpdate.exe	128
PID 4620 wrote to memory of 2508	4620	MicrosoftEdgeUpdate.exe	129
PID 4620 wrote to memory of 2508	4620	MicrosoftEdgeUpdate.exe	129
PID 4620 wrote to memory of 2508	4620	MicrosoftEdgeUpdate.exe	129
PID 4620 wrote to memory of 4224	4620	MicrosoftEdgeUpdate.exe	130
PID 4620 wrote to memory of 4224	4620	MicrosoftEdgeUpdate.exe	130
PID 4620 wrote to memory of 4224	4620	MicrosoftEdgeUpdate.exe	130
PID 4828 wrote to memory of 2208	4828	MicrosoftEdgeUpdate.exe	132
PID 4828 wrote to memory of 2208	4828	MicrosoftEdgeUpdate.exe	132
PID 4828 wrote to memory of 2208	4828	MicrosoftEdgeUpdate.exe	132
PID 4828 wrote to memory of 228	4828	MicrosoftEdgeUpdate.exe	133
PID 4828 wrote to memory of 228	4828	MicrosoftEdgeUpdate.exe	133
PID 4828 wrote to memory of 228	4828	MicrosoftEdgeUpdate.exe	133
PID 4828 wrote to memory of 2360	4828	MicrosoftEdgeUpdate.exe	135
PID 4828 wrote to memory of 2360	4828	MicrosoftEdgeUpdate.exe	135
PID 4828 wrote to memory of 2360	4828	MicrosoftEdgeUpdate.exe	135
PID 4828 wrote to memory of 1408	4828	MicrosoftEdgeUpdate.exe	136
PID 4828 wrote to memory of 1408	4828	MicrosoftEdgeUpdate.exe	136
PID 1408 wrote to memory of 3940	1408	MicrosoftEdgeWebview_X64_118.0.2088.69.exe	137
PID 1408 wrote to memory of 3940	1408	MicrosoftEdgeWebview_X64_118.0.2088.69.exe	137
PID 4828 wrote to memory of 2224	4828	MicrosoftEdgeUpdate.exe	144
PID 4828 wrote to memory of 2224	4828	MicrosoftEdgeUpdate.exe	144
PID 4828 wrote to memory of 2224	4828	MicrosoftEdgeUpdate.exe	144

C:\Users\Admin\AppData\Local\Temp\dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe
"C:\Users\Admin\AppData\Local\Temp\dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\4286bfca-e79a-461e-81a7-21e361ede39c.msi" /quiet /norestart AUTOSTART_WITH_WINDOWS=false
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c timeout /NOBREAK /T 3 > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\dec5f022a4ad783d8aa86ab942af058de15672bded1e658144be3bebe83f2576.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\timeout.exe
    timeout /NOBREAK /T 3
    3⤵
    - Delays execution with timeout.exe
    PID:972
- C:\Users\Admin\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe
  "C:\Users\Admin\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe" /protocolUri="webex://meet/?bt=12&bv=124&cr=b78dee4c-4867-44e7-a42d-9d5e3d83f910&dns=oncor.webex.com&en=3&flag=49&joinTXId=XpW4FhTgV9&jt=eyJkdDAiOjE3MTYyNjc1NTYsImR0MSI6NTIzLCJkdDIiOjIzNCwiZHQzIjozMTMyLCJkdDQiOjI5MjI0LCJkdDUiOjkwNTAsImR0NiI6MTcxNjI2NzU5OSwiZnQiOjEsInQiOjMyLCJ1cCI6MX0&od=1df51ee8-41e5-49a0-9494-38d1c4b68458&rc=4&[email protected]&siteurl=oncor&tr=E7E7257C184B4BC6BEA6D8F5AE42B555_1715351073738&uuid=b35d2a8b14e943e2941774b2858619cf&vp=0"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Users\Admin\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe
    "C:\Users\Admin\AppData\Local\CiscoSparkLauncher\CiscoCollabHost.exe" "C:\Users\Admin\AppData\Local\CiscoSparkLauncher\44.5.0.29672_ad7d5d18-176d-4792-8444-870158a84d35" spark-windows-app.dll /Hosted=true "C:\Users\Admin\AppData\Local\Programs\Cisco Spark\CiscoCollabHost.exe" /protocolUri="webex://meet/?bt=12&bv=124&cr=b78dee4c-4867-44e7-a42d-9d5e3d83f910&dns=oncor.webex.com&en=3&flag=49&joinTXId=XpW4FhTgV9&jt=eyJkdDAiOjE3MTYyNjc1NTYsImR0MSI6NTIzLCJkdDIiOjIzNCwiZHQzIjozMTMyLCJkdDQiOjI5MjI0LCJkdDUiOjkwNTAsImR0NiI6MTcxNjI2NzU5OSwiZnQiOjEsInQiOjMyLCJ1cCI6MX0&od=1df51ee8-41e5-49a0-9494-38d1c4b68458&rc=4&[email protected]&siteurl=oncor&tr=E7E7257C184B4BC6BEA6D8F5AE42B555_1715351073738&uuid=b35d2a8b14e943e2941774b2858619cf&vp=0"
    3⤵
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c start /B /WAIT "WebView2Installer" "C:\Users\Admin\AppData\Local\Temp\\WebView2Runtime\MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe" /silent /install
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\WebView2Runtime\MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\WebView2Runtime\MicrosoftEdgeWebView2RuntimeInstaller_118.0.2088.69.exe" /silent /install
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:3052
      - C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EUDE45.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"
        6⤵
        Sets file execution options in registry
        Checks computer location settings
        Executes dropped EXE
        Checks system information in the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1168
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:3576
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:2448
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:3032
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzcuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzcuMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDUxNUNFMUYtREM1Ni00RkFFLUIwMjAtN0QxQzhDNDc3MDI4fSIgdXNlcmlkPSJ7N0U0RDVFRjItQ0UzMS00MTc0LTkzMEItQkE2MjZGOEY1QjQ0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntEQkMyRTBBQy05RUM1LTQxNDktOEQwOC0xNjE4QTY5QkMwNUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0R4T2JqSEdhK25SYTJhdEMzd28rSUVwQzc4K1pZZUFVYmtYcERDMmNqN1U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTc3LjExIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzAxMzk2NDAyIiBpbnN0YWxsX3RpbWVfbXM9IjU5MyIvPjwvYXBwPjwvcmVxdWVzdD4
        7⤵
        Executes dropped EXE
        Checks system information in the registry
        
        PID:2508
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers" /installsource offline /sessionid "{D515CE1F-DC56-4FAE-B020-7D1C8C477028}" /silent /offlinedir "{523B33CC-EDBD-445D-81C1-42AB6F6047D0}"
        7⤵
        Executes dropped EXE
        
        PID:4224

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 49868B1DEF2218A2A652AF6CF5ED53BE
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\system32\\taskkill.exe" /F /IM CiscoCollabHost.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D6360462DC184112F4D62B730CE8920C
  2⤵
  PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3764,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:8
1⤵
PID:4252

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzcuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzcuMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDUxNUNFMUYtREM1Ni00RkFFLUIwMjAtN0QxQzhDNDc3MDI4fSIgdXNlcmlkPSJ7N0U0RDVFRjItQ0UzMS00MTc0LTkzMEItQkE2MjZGOEY1QjQ0fSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7NEVDQzUxQTktNTU0RS00QzlELTg1NDAtNDBDOUUwREUwRkFBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtFK3hiQXo2WTZzVTEyODliUzZxbDRWUkxia2pmQlVHVE1Kc2pySHI0NGlJPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbmV4dHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTcwNTQ1ODk5OSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  PID:2208
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4828" "1104" "1036" "1108" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:228
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzcuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzcuMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDUxNUNFMUYtREM1Ni00RkFFLUIwMjAtN0QxQzhDNDc3MDI4fSIgdXNlcmlkPSJ7N0U0RDVFRjItQ0UzMS00MTc0LTkzMEItQkE2MjZGOEY1QjQ0fSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7OUREQUJCOUYtMTg2MS00QkIzLUJENjctMkIwMTIyOEJCMjJEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSIxMjQuMC4yNDc4LjgwIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTIiIGluc3RhbGxkYXRldGltZT0iMTcxNTE5NTMwMyI-PGV2ZW50IGV2ZW50dHlwZT0iMzIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjQiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3MTQ4MzM5ODEiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  PID:2360
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{59BBD5AD-76FE-4A60-B211-ACE719360507}\MicrosoftEdgeWebview_X64_118.0.2088.69.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{59BBD5AD-76FE-4A60-B211-ACE719360507}\MicrosoftEdgeWebview_X64_118.0.2088.69.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{59BBD5AD-76FE-4A60-B211-ACE719360507}\EDGEMITMP_4E8B6.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{59BBD5AD-76FE-4A60-B211-ACE719360507}\EDGEMITMP_4E8B6.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{59BBD5AD-76FE-4A60-B211-ACE719360507}\MicrosoftEdgeWebview_X64_118.0.2088.69.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:3940
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzcuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzcuMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDUxNUNFMUYtREM1Ni00RkFFLUIwMjAtN0QxQzhDNDc3MDI4fSIgdXNlcmlkPSJ7N0U0RDVFRjItQ0UzMS00MTc0LTkzMEItQkE2MjZGOEY1QjQ0fSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7REFENDBFMjMtM0Q1Ny00MDdELTg5RjYtNEQ0Q0UxQjE2MTFEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMTguMC4yMDg4LjY5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzE3MzMzOTQ1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTcxNzMzMzk0NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3MjY4NjU1MDMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzM5NTIxOTcwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1OTkxMDg0NTMzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVkPSIxNjMwMjg5MzYiIHRvdGFsPSIxNjMwMjg5MzYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIxIiBpbnN0YWxsX3RpbWVfbXM9IjI1MTU2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery