gh0strat | dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320

Modify Registry

T1112

Processes:

R.exeR.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240605500.txt"	R.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240609484.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

HD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	HD_msedge.exe

Executes dropped EXE 24 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exemsedge.exeR.exeN.exeTXPlatfor.exeTXPlatfor.exeRemote Data.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exeHD_msedge.exe

pid	process
1164	R.exe
900	N.exe
4612	TXPlatfor.exe
3792	TXPlatfor.exe
4040	HD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
5096	msedge.exe
1996	R.exe
1392	N.exe
3320	TXPlatfor.exe
3896	TXPlatfor.exe
1424	Remote Data.exe
2912	HD_msedge.exe
5024	HD_msedge.exe
4180	HD_msedge.exe
3152	HD_msedge.exe
5016	HD_msedge.exe
3796	HD_msedge.exe
1092	HD_msedge.exe
4468	HD_msedge.exe
1852	HD_msedge.exe
964	HD_msedge.exe
4624	HD_msedge.exe
5268	HD_msedge.exe
5784	HD_msedge.exe

Loads dropped DLL 4 IoCs

Processes:

R.exesvchost.exeR.exeRemote Data.exe

pid process

1164 R.exe
380 svchost.exe
1996 R.exe
1424 Remote Data.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/900-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/900-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/900-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/900-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4612-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4612-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4612-27-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3792-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3792-43-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3792-45-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\HD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	vmprotect
behavioral2/memory/4040-46-0x0000000000D10000-0x0000000000D96000-memory.dmp	vmprotect

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

HD_msedge.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA HD_msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HD_msedge.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

HD_msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	HD_msedge.exe

Drops file in System32 directory 8 IoCs

Processes:

N.exeR.exeR.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\240609484.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\240605500.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe

Drops file in Program Files directory 3 IoCs

Processes:

dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exemsedge.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

HD_msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	HD_msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

3628 PING.EXE
2372 PING.EXE

pid	process
3628	PING.EXE
2372	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exemsedge.exeHD_msedge.exeHD_msedge.exeidentity_helper.exeHD_msedge.exe

pid	process
2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
5096	msedge.exe
5096	msedge.exe
3152	HD_msedge.exe
3152	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
1572	identity_helper.exe
1572	identity_helper.exe
5784	HD_msedge.exe
5784	HD_msedge.exe
5784	HD_msedge.exe
5784	HD_msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

3792 TXPlatfor.exe

pid	process
3792	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

N.exeTXPlatfor.exeN.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	900	N.exe
Token: SeLoadDriverPrivilege	3792	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	1392	N.exe
Token: 33	3792	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	3792	TXPlatfor.exe
Token: 33	3792	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	3792	TXPlatfor.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

HD_msedge.exe

pid	process
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

HD_msedge.exe

pid	process
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe
2912	HD_msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exemsedge.exe

pid	process
2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exeN.exeTXPlatfor.execmd.exeHD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exemsedge.exeN.exeTXPlatfor.exesvchost.exeHD_msedge.exe

description	pid	process	target process
PID 2548 wrote to memory of 1164	2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	R.exe
PID 2548 wrote to memory of 1164	2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	R.exe
PID 2548 wrote to memory of 1164	2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	R.exe
PID 2548 wrote to memory of 900	2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	N.exe
PID 2548 wrote to memory of 900	2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	N.exe
PID 2548 wrote to memory of 900	2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	N.exe
PID 900 wrote to memory of 2032	900	N.exe	cmd.exe
PID 900 wrote to memory of 2032	900	N.exe	cmd.exe
PID 900 wrote to memory of 2032	900	N.exe	cmd.exe
PID 4612 wrote to memory of 3792	4612	TXPlatfor.exe	TXPlatfor.exe
PID 4612 wrote to memory of 3792	4612	TXPlatfor.exe	TXPlatfor.exe
PID 4612 wrote to memory of 3792	4612	TXPlatfor.exe	TXPlatfor.exe
PID 2032 wrote to memory of 3628	2032	cmd.exe	PING.EXE
PID 2032 wrote to memory of 3628	2032	cmd.exe	PING.EXE
PID 2032 wrote to memory of 3628	2032	cmd.exe	PING.EXE
PID 2548 wrote to memory of 4040	2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	HD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
PID 2548 wrote to memory of 4040	2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	HD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
PID 2548 wrote to memory of 4040	2548	dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	HD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
PID 4040 wrote to memory of 5096	4040	HD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	msedge.exe
PID 4040 wrote to memory of 5096	4040	HD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	msedge.exe
PID 4040 wrote to memory of 5096	4040	HD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe	msedge.exe
PID 5096 wrote to memory of 1996	5096	msedge.exe	R.exe
PID 5096 wrote to memory of 1996	5096	msedge.exe	R.exe
PID 5096 wrote to memory of 1996	5096	msedge.exe	R.exe
PID 5096 wrote to memory of 1392	5096	msedge.exe	N.exe
PID 5096 wrote to memory of 1392	5096	msedge.exe	N.exe
PID 5096 wrote to memory of 1392	5096	msedge.exe	N.exe
PID 1392 wrote to memory of 1584	1392	N.exe	cmd.exe
PID 1392 wrote to memory of 1584	1392	N.exe	cmd.exe
PID 1392 wrote to memory of 1584	1392	N.exe	cmd.exe
PID 3320 wrote to memory of 3896	3320	TXPlatfor.exe	TXPlatfor.exe
PID 3320 wrote to memory of 3896	3320	TXPlatfor.exe	TXPlatfor.exe
PID 3320 wrote to memory of 3896	3320	TXPlatfor.exe	TXPlatfor.exe
PID 380 wrote to memory of 1424	380	svchost.exe	Remote Data.exe
PID 380 wrote to memory of 1424	380	svchost.exe	Remote Data.exe
PID 380 wrote to memory of 1424	380	svchost.exe	Remote Data.exe
PID 5096 wrote to memory of 2912	5096	msedge.exe	HD_msedge.exe
PID 5096 wrote to memory of 2912	5096	msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 5024	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 5024	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe
PID 2912 wrote to memory of 4180	2912	HD_msedge.exe	HD_msedge.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

HD_msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection HD_msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	HD_msedge.exe

C:\Users\Admin\AppData\Local\Temp\dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
"C:\Users\Admin\AppData\Local\Temp\dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1164

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:3628

C:\Users\Admin\AppData\Local\Temp\HD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
C:\Users\Admin\AppData\Local\Temp\HD_dbbc5c04662f8c2f42b1346225f60e8eae47f36ba405237f2caaf72ad651e320.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://jq.qq.com/?_wv=1027&k=a1Npzmf5
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
4⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1996

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
5⤵
PID:1584

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
6⤵
- Runs ping.exe
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks system information in the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd086a46f8,0x7ffd086a4708,0x7ffd086a4718
5⤵
- Executes dropped EXE
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
5⤵
- Executes dropped EXE
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
5⤵
- Executes dropped EXE
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
5⤵
PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:5268

C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2012,9913383112027966885,1541712789528006137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5784

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:3616

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:380

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240605500.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Executes dropped EXE
PID:3896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery