xenorat | 965a32e8b7471c231484f575318a8d4ce4ce442ad7644a330515ace6f5678465

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sus.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	sus.exe

Executes dropped EXE 1 IoCs

pid	Process
4300	sus.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ee7db508-e924-4475-b380-4b88449379c8.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241130135716.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "218"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{A4FD30DF-8B57-474C-A684-235CD2C9428C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
4300	sus.exe
2176	msedge.exe
2176	msedge.exe
4044	msedge.exe
4044	msedge.exe
4432	msedge.exe
4432	msedge.exe
3856	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4300	sus.exe
Token: SeDebugPrivilege	5424	taskmgr.exe
Token: SeSystemProfilePrivilege	5424	taskmgr.exe
Token: SeCreateGlobalPrivilege	5424	taskmgr.exe
Token: SeShutdownPrivilege	5132	shutdown.exe
Token: SeRemoteShutdownPrivilege	5132	shutdown.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
1920	msedge.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe
5424	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5972	LogonUI.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4300	3208	sus.exe	83
PID 3208 wrote to memory of 4300	3208	sus.exe	83
PID 3208 wrote to memory of 4300	3208	sus.exe	83
PID 4300 wrote to memory of 2272	4300	sus.exe	84
PID 4300 wrote to memory of 2272	4300	sus.exe	84
PID 4300 wrote to memory of 2272	4300	sus.exe	84
PID 4300 wrote to memory of 1920	4300	sus.exe	95
PID 4300 wrote to memory of 1920	4300	sus.exe	95
PID 1920 wrote to memory of 3004	1920	msedge.exe	96
PID 1920 wrote to memory of 3004	1920	msedge.exe	96
PID 1920 wrote to memory of 2176	1920	msedge.exe	97
PID 1920 wrote to memory of 2176	1920	msedge.exe	97
PID 1920 wrote to memory of 4044	1920	msedge.exe	98
PID 1920 wrote to memory of 4044	1920	msedge.exe	98
PID 1920 wrote to memory of 4432	1920	msedge.exe	99
PID 1920 wrote to memory of 4432	1920	msedge.exe	99
PID 1920 wrote to memory of 4772	1920	msedge.exe	100
PID 1920 wrote to memory of 4772	1920	msedge.exe	100
PID 1920 wrote to memory of 3856	1920	msedge.exe	101
PID 1920 wrote to memory of 3856	1920	msedge.exe	101
PID 1920 wrote to memory of 3248	1920	msedge.exe	102
PID 1920 wrote to memory of 3248	1920	msedge.exe	102
PID 1920 wrote to memory of 972	1920	msedge.exe	103
PID 1920 wrote to memory of 972	1920	msedge.exe	103
PID 1920 wrote to memory of 716	1920	msedge.exe	104
PID 1920 wrote to memory of 716	1920	msedge.exe	104
PID 1920 wrote to memory of 1200	1920	msedge.exe	105
PID 1920 wrote to memory of 1200	1920	msedge.exe	105
PID 1920 wrote to memory of 544	1920	msedge.exe	106
PID 1920 wrote to memory of 544	1920	msedge.exe	106
PID 1920 wrote to memory of 4524	1920	msedge.exe	107
PID 1920 wrote to memory of 4524	1920	msedge.exe	107
PID 1920 wrote to memory of 2968	1920	msedge.exe	110
PID 1920 wrote to memory of 2968	1920	msedge.exe	110
PID 1920 wrote to memory of 3488	1920	msedge.exe	111
PID 1920 wrote to memory of 3488	1920	msedge.exe	111
PID 1920 wrote to memory of 5272	1920	msedge.exe	112
PID 1920 wrote to memory of 5272	1920	msedge.exe	112
PID 1920 wrote to memory of 5280	1920	msedge.exe	113
PID 1920 wrote to memory of 5280	1920	msedge.exe	113
PID 1920 wrote to memory of 5576	1920	msedge.exe	115
PID 1920 wrote to memory of 5568	1920	msedge.exe	114
PID 1920 wrote to memory of 5568	1920	msedge.exe	114
PID 5568 wrote to memory of 5600	5568	setup.exe	117
PID 5568 wrote to memory of 5600	5568	setup.exe	117
PID 1920 wrote to memory of 5840	1920	msedge.exe	119
PID 1920 wrote to memory of 5840	1920	msedge.exe	119
PID 1920 wrote to memory of 5840	1920	msedge.exe	119
PID 1920 wrote to memory of 5840	1920	msedge.exe	119
PID 1920 wrote to memory of 5852	1920	msedge.exe	120
PID 1920 wrote to memory of 5852	1920	msedge.exe	120
PID 1920 wrote to memory of 632	1920	msedge.exe	122
PID 1920 wrote to memory of 632	1920	msedge.exe	122
PID 1920 wrote to memory of 3856	1920	msedge.exe	123
PID 1920 wrote to memory of 3856	1920	msedge.exe	123
PID 1920 wrote to memory of 5408	1920	msedge.exe	124
PID 1920 wrote to memory of 5408	1920	msedge.exe	124
PID 4300 wrote to memory of 5132	4300	sus.exe	126
PID 4300 wrote to memory of 5132	4300	sus.exe	126
PID 4300 wrote to memory of 5132	4300	sus.exe	126

C:\Users\Admin\AppData\Local\Temp\sus.exe
"C:\Users\Admin\AppData\Local\Temp\sus.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\XenoManager\sus.exe
  "C:\Users\Admin\AppData\Local\Temp\XenoManager\sus.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "suss.exe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8A10.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --user-data-dir=C:\EdgeAutomationData
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\EdgeAutomationData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\EdgeAutomationData\Crashpad --metrics-dir=C:\EdgeAutomationData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbfa9b46f8,0x7ffbfa9b4708,0x7ffbfa9b4718
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --no-sandbox --user-data-dir="C:\EdgeAutomationData" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2104 --allow-no-sandbox-job /prefetch:2
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\EdgeAutomationData" --mojo-platform-channel-handle=2140 --allow-no-sandbox-job /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\EdgeAutomationData" --mojo-platform-channel-handle=2536 --allow-no-sandbox-job /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 --allow-no-sandbox-job /prefetch:1
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2452 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:5568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff710a85460,0x7ff710a85470,0x7ff710a85480
        5⤵
        
        PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\EdgeAutomationData" --mojo-platform-channel-handle=5472 --allow-no-sandbox-job /prefetch:8
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\EdgeAutomationData" --mojo-platform-channel-handle=5472 --allow-no-sandbox-job /prefetch:8
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=2084,2256678067054019478,6282284941965622260,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:5408
- - C:\Windows\SysWOW64\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 0
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5132

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5424

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa397f055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery