c1b64a1f5f197d061a7027f9b4b142f2d53c66a71c95eb41659c717c703ca562

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\Cake\\yae_wallpaper.jpg"	reg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

pid	Process
1832	timeout.exe

Kills process with taskkill 1 IoCs

pid	Process
4216	taskkill.exe

Modifies Control Panel 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Cursors\ = "Windows Default"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Cursors\Scheme Source = "2"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Accessibility\HighContrast\Previous High Contrast Scheme MUI Value	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Desktop\UserPreferencesMask = 9e1e078012000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Cursors	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Accessibility\HighContrast	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Accessibility\HighContrast\Flags = "126"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Accessibility\HighContrast\High Contrast Scheme	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Appearance	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Appearance\NewCurrent	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Control Panel\Appearance\Current	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0687d165cbdada01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f799e465cbdada01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000d97e73ca39c608cb032c5b4672461de96913dbde7d5805cf4e850b08d20a5a8741567b7502e06065cdfe832b391ce3f325cc44f0ad4918a644c8	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 62adf765cbdada01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	cmd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

pid	Process
5784	reg.exe
5916	reg.exe
6120	reg.exe
5236	reg.exe
5516	reg.exe
5848	reg.exe
6000	reg.exe
5308	reg.exe
5604	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4804	schtasks.exe
5520	schtasks.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
5132	Process not Found
1808	Process not Found
4024	Process not Found
680	Process not Found
4728	Process not Found
1832	Process not Found
3132	Process not Found
5476	Process not Found
5136	Process not Found
4196	Process not Found
4740	Process not Found
4800	Process not Found
1056	Process not Found
4844	Process not Found
3536	Process not Found
1780	Process not Found
3972	Process not Found
5068	Process not Found
736	Process not Found
4840	Process not Found
4700	Process not Found
1916	Process not Found
4480	Process not Found
1684	Process not Found
4864	Process not Found
4016	Process not Found
2628	Process not Found
3512	Process not Found
4664	Process not Found
4532	Process not Found
4580	Process not Found
1708	Process not Found
2168	Process not Found
1860	Process not Found
4592	Process not Found
1480	Process not Found
4916	Process not Found
2240	Process not Found
4064	Process not Found
1784	Process not Found
3580	Process not Found
4588	Process not Found
5376	Process not Found
3128	Process not Found
1304	Process not Found
3684	Process not Found
68	Process not Found
924	Process not Found
1648	Process not Found
5352	Process not Found
5396	Process not Found
5372	Process not Found
5356	Process not Found
2160	Process not Found
1392	Process not Found
5364	Process not Found
5348	Process not Found
5436	Process not Found
5572	Process not Found
5384	Process not Found
5408	Process not Found
5496	Process not Found
5420	Process not Found
5380	Process not Found

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1260	MicrosoftEdgeCP.exe
1260	MicrosoftEdgeCP.exe
1260	MicrosoftEdgeCP.exe
1260	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4284	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4284	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4284	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4216	taskkill.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
764	MicrosoftEdge.exe
1260	MicrosoftEdgeCP.exe
4284	MicrosoftEdgeCP.exe
1260	MicrosoftEdgeCP.exe
5948	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2868	1948	pretty.exe	73
PID 1948 wrote to memory of 2868	1948	pretty.exe	73
PID 2868 wrote to memory of 4796	2868	pretty.exe	74
PID 2868 wrote to memory of 4796	2868	pretty.exe	74
PID 2868 wrote to memory of 2484	2868	pretty.exe	76
PID 2868 wrote to memory of 2484	2868	pretty.exe	76
PID 2484 wrote to memory of 4804	2484	cmd.exe	78
PID 2484 wrote to memory of 4804	2484	cmd.exe	78
PID 1260 wrote to memory of 2956	1260	MicrosoftEdgeCP.exe	83
PID 1260 wrote to memory of 2956	1260	MicrosoftEdgeCP.exe	83
PID 1260 wrote to memory of 2956	1260	MicrosoftEdgeCP.exe	83
PID 1260 wrote to memory of 2956	1260	MicrosoftEdgeCP.exe	83
PID 1260 wrote to memory of 2956	1260	MicrosoftEdgeCP.exe	83
PID 1260 wrote to memory of 2956	1260	MicrosoftEdgeCP.exe	83
PID 2868 wrote to memory of 3996	2868	pretty.exe	84
PID 2868 wrote to memory of 3996	2868	pretty.exe	84
PID 3996 wrote to memory of 3804	3996	cmd.exe	86
PID 3996 wrote to memory of 3804	3996	cmd.exe	86
PID 3996 wrote to memory of 1832	3996	cmd.exe	87
PID 3996 wrote to memory of 1832	3996	cmd.exe	87
PID 3996 wrote to memory of 4216	3996	cmd.exe	88
PID 3996 wrote to memory of 4216	3996	cmd.exe	88
PID 2868 wrote to memory of 5460	2868	pretty.exe	90
PID 2868 wrote to memory of 5460	2868	pretty.exe	90
PID 5460 wrote to memory of 5784	5460	cmd.exe	92
PID 5460 wrote to memory of 5784	5460	cmd.exe	92
PID 2868 wrote to memory of 5800	2868	pretty.exe	93
PID 2868 wrote to memory of 5800	2868	pretty.exe	93
PID 5800 wrote to memory of 5848	5800	cmd.exe	95
PID 5800 wrote to memory of 5848	5800	cmd.exe	95
PID 2868 wrote to memory of 5864	2868	pretty.exe	96
PID 2868 wrote to memory of 5864	2868	pretty.exe	96
PID 5864 wrote to memory of 5916	5864	cmd.exe	98
PID 5864 wrote to memory of 5916	5864	cmd.exe	98
PID 2868 wrote to memory of 5932	2868	pretty.exe	99
PID 2868 wrote to memory of 5932	2868	pretty.exe	99
PID 5932 wrote to memory of 6000	5932	cmd.exe	102
PID 5932 wrote to memory of 6000	5932	cmd.exe	102
PID 2868 wrote to memory of 6020	2868	pretty.exe	104
PID 2868 wrote to memory of 6020	2868	pretty.exe	104
PID 6020 wrote to memory of 6120	6020	cmd.exe	106
PID 6020 wrote to memory of 6120	6020	cmd.exe	106
PID 2868 wrote to memory of 3028	2868	pretty.exe	107
PID 2868 wrote to memory of 3028	2868	pretty.exe	107
PID 3028 wrote to memory of 5308	3028	cmd.exe	109
PID 3028 wrote to memory of 5308	3028	cmd.exe	109
PID 2868 wrote to memory of 5288	2868	pretty.exe	110
PID 2868 wrote to memory of 5288	2868	pretty.exe	110
PID 5288 wrote to memory of 5236	5288	cmd.exe	112
PID 5288 wrote to memory of 5236	5288	cmd.exe	112
PID 2868 wrote to memory of 5216	2868	pretty.exe	113
PID 2868 wrote to memory of 5216	2868	pretty.exe	113
PID 5216 wrote to memory of 5164	5216	cmd.exe	115
PID 5216 wrote to memory of 5164	5216	cmd.exe	115
PID 2868 wrote to memory of 5148	2868	pretty.exe	116
PID 2868 wrote to memory of 5148	2868	pretty.exe	116
PID 5148 wrote to memory of 2608	5148	cmd.exe	118
PID 5148 wrote to memory of 2608	5148	cmd.exe	118
PID 2868 wrote to memory of 5476	2868	pretty.exe	119
PID 2868 wrote to memory of 5476	2868	pretty.exe	119
PID 5476 wrote to memory of 3132	5476	cmd.exe	121
PID 5476 wrote to memory of 3132	5476	cmd.exe	121
PID 2868 wrote to memory of 2212	2868	pretty.exe	122
PID 2868 wrote to memory of 2212	2868	pretty.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

pid	Process
5468	attrib.exe

C:\Users\Admin\AppData\Local\Temp\pretty.exe
"C:\Users\Admin\AppData\Local\Temp\pretty.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\pretty.exe
  "C:\Users\Admin\AppData\Local\Temp\pretty.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "pretty" /tr "C:\ProgramData\Cake\pretty.exe" /sc ONLOGON /rl HIGHEST /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "pretty" /tr "C:\ProgramData\Cake\pretty.exe" /sc ONLOGON /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "C:\Windows\Resources\Themes\aero.theme" & timeout /t 3 & taskkill /im "systemsettings.exe" /f"
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\themecpl.dll,OpenThemeAction C:\Windows\Resources\Themes\aero.theme
      4⤵
      Modifies Control Panel
      PID:3804
  - - C:\Windows\system32\timeout.exe
      timeout /t 3
      4⤵
      Delays execution with timeout.exe
      PID:1832
  - - C:\Windows\system32\taskkill.exe
      taskkill /im "systemsettings.exe" /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\Windows\system32\reg.exe
      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\system32\reg.exe
      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:5848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v SystemUsesLightTheme /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\system32\reg.exe
      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v SystemUsesLightTheme /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v ColorPrevalence /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Windows\system32\reg.exe
      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v ColorPrevalence /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent /v StartColorMenu /t REG_DWORD /d 0xff7878e7 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Windows\system32\reg.exe
      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent /v StartColorMenu /t REG_DWORD /d 0xff7878e7 /f
      4⤵
      Modifies registry key
      PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent /v AccentColorMenu /t REG_DWORD /d 0xff8e8eeb /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\system32\reg.exe
      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent /v AccentColorMenu /t REG_DWORD /d 0xff8e8eeb /f
      4⤵
      Modifies registry key
      PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent /v AccentPalette /t REG_BINARY /d ce43aaffce43aaffce43aaffce43aaffce43aaffce43aaffce43aaffce43aa00 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5288
  - - C:\Windows\system32\reg.exe
      reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent /v AccentPalette /t REG_BINARY /d ce43aaffce43aaffce43aaffce43aaffce43aaffce43aaffce43aaffce43aa00 /f
      4⤵
      Modifies registry key
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 200 220" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveTitle /t REG_SZ /d "255 120 150" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveTitle /t REG_SZ /d "255 120 150" /f
      4⤵
      PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v AppWorkspace /t REG_SZ /d "255 180 200" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5476
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v AppWorkspace /t REG_SZ /d "255 180 200" /f
      4⤵
      PID:3132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:2212
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ButtonAlternateFace /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:696
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ButtonAlternateFace /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ButtonDkShadow /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:4532
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ButtonDkShadow /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ButtonFace /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:360
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ButtonFace /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ButtonHilight /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:4940
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ButtonHilight /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:1648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ButtonLight /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:5080
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ButtonLight /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ButtonShadow /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:5380
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ButtonShadow /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ButtonText /t REG_SZ /d "255 255 255" /f"
    3⤵
    PID:5440
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ButtonText /t REG_SZ /d "255 255 255" /f
      4⤵
      PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v GradientActiveTitle /t REG_SZ /d "255 120 150" /f"
    3⤵
    PID:5580
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v GradientActiveTitle /t REG_SZ /d "255 120 150" /f
      4⤵
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v GradientInactiveTitle /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:5504
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v GradientInactiveTitle /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v GrayText /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:5652
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v GrayText /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Hilight /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:5668
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Hilight /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v HilightText /t REG_SZ /d "255 255 255" /f"
    3⤵
    PID:5492
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v HilightText /t REG_SZ /d "255 255 255" /f
      4⤵
      PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v HotTrackingColor /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:5844
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v HotTrackingColor /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v InactiveBorder /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:5916
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v InactiveBorder /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v InactiveTitle /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:5988
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v InactiveTitle /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v InactiveTitleText /t REG_SZ /d "255 255 255" /f"
    3⤵
    PID:6120
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v InactiveTitleText /t REG_SZ /d "255 255 255" /f
      4⤵
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v InfoText /t REG_SZ /d "255 255 255" /f"
    3⤵
    PID:2984
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v InfoText /t REG_SZ /d "255 255 255" /f
      4⤵
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v InfoWindow /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:5268
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v InfoWindow /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Menu /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:3020
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Menu /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:5172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v MenuBar /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:5196
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v MenuBar /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:5148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v MenuHilight /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:5136
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v MenuHilight /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:5476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v MenuText /t REG_SZ /d "255 255 255" /f"
    3⤵
    PID:2484
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v MenuText /t REG_SZ /d "255 255 255" /f
      4⤵
      PID:824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Scrollbar /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:2212
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Scrollbar /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v TitleText /t REG_SZ /d "255 255 255" /f"
    3⤵
    PID:2432
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v TitleText /t REG_SZ /d "255 255 255" /f
      4⤵
      PID:920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Window /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:2404
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Window /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v WindowFrame /t REG_SZ /d "255 200 220" /f"
    3⤵
    PID:1520
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v WindowFrame /t REG_SZ /d "255 200 220" /f
      4⤵
      PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v WindowText /t REG_SZ /d "255 255 255" /f"
    3⤵
    PID:5368
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v WindowText /t REG_SZ /d "255 255 255" /f
      4⤵
      PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Desktop" /v WallPaper /t REG_SZ /d C:\ProgramData\Cake\yae_wallpaper.jpg /f"
    3⤵
    PID:5412
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Desktop" /v WallPaper /t REG_SZ /d C:\ProgramData\Cake\yae_wallpaper.jpg /f
      4⤵
      Sets desktop wallpaper using registry
      PID:5496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f"
    3⤵
    PID:5544
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v NoDispAppearancePage /t REG_DWORD /d 1 /f"
    3⤵
    PID:5616
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v NoDispAppearancePage /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn pretty_lock /tr "C:\ProgramData\Cake\lock_file.bat" /ru "NT AUTHORITY\SYSTEM" /rl HIGHEST /sc ONLOGON"
    3⤵
    PID:5500
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn pretty_lock /tr "C:\ProgramData\Cake\lock_file.bat" /ru "NT AUTHORITY\SYSTEM" /rl HIGHEST /sc ONLOGON
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /run /tn pretty_lock"
    3⤵
    PID:5716
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn pretty_lock
      4⤵
      PID:5696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /delete /tn pretty_lock /F"
    3⤵
    PID:5852
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn pretty_lock /F
      4⤵
      PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown -l
    3⤵
    PID:5824
  - - C:\Windows\system32\shutdown.exe
      shutdown -l
      4⤵
      PID:6008

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:764

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:368

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4284

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2956

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c "C:\ProgramData\Cake\lock_file.bat"
1⤵
PID:5484
- C:\Windows\system32\takeown.exe
  takeown /f "C:\ProgramData\Cake\pretty.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5752
- C:\Windows\system32\attrib.exe
  attrib +r +s "C:\ProgramData\Cake\pretty.exe"
  2⤵
  - Views/modifies file attributes
  PID:5468
- C:\Windows\system32\icacls.exe
  icacls "C:\ProgramData\Cake\pretty.exe" /remove *S-1-5-32-545
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5820
- C:\Windows\system32\icacls.exe
  icacls "C:\ProgramData\Cake\pretty.exe" /inheritance:r /grant:r *S-1-5-32-545:RX /deny *S-1-5-32-545:(de,WO,WDAC) /grant:r *S-1-5-32-544:RX /deny *S-1-5-32-544:(de,WO,WDAC)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5860

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3af9855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5948

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:6056

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry