dcrat | add6234329d65ae878b6112d7d63d6641b842d28c0fa2fa5fbbb09a1b835bc0c

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\0154351536fc379faee1\\fontdrvhost.exe\", \"C:\\0154351536fc379faee1\\smss.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\0154351536fc379faee1\\fontdrvhost.exe\", \"C:\\0154351536fc379faee1\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\0154351536fc379faee1\\fontdrvhost.exe\", \"C:\\0154351536fc379faee1\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\sihost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\0154351536fc379faee1\\fontdrvhost.exe\", \"C:\\0154351536fc379faee1\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\sihost.exe\", \"C:\\0154351536fc379faee1\\dwm.exe\", \"C:\\3ac54ddf2ad44faa6035cf\\fontdrvhost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\0154351536fc379faee1\\fontdrvhost.exe\", \"C:\\0154351536fc379faee1\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\sihost.exe\", \"C:\\0154351536fc379faee1\\dwm.exe\", \"C:\\3ac54ddf2ad44faa6035cf\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Media Player\\es-ES\\OfficeClickToRun.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\sihost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\0154351536fc379faee1\\fontdrvhost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\0154351536fc379faee1\\fontdrvhost.exe\", \"C:\\0154351536fc379faee1\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\explorer.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\0154351536fc379faee1\\fontdrvhost.exe\", \"C:\\0154351536fc379faee1\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\sihost.exe\", \"C:\\0154351536fc379faee1\\dwm.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\0154351536fc379faee1\\fontdrvhost.exe\", \"C:\\0154351536fc379faee1\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\sihost.exe\", \"C:\\0154351536fc379faee1\\dwm.exe\", \"C:\\3ac54ddf2ad44faa6035cf\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Media Player\\es-ES\\OfficeClickToRun.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\0154351536fc379faee1\\fontdrvhost.exe\", \"C:\\0154351536fc379faee1\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\sihost.exe\", \"C:\\0154351536fc379faee1\\dwm.exe\", \"C:\\3ac54ddf2ad44faa6035cf\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Media Player\\es-ES\\OfficeClickToRun.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\sihost.exe\", \"C:\\0154351536fc379faee1\\RuntimeBroker.exe\""	231f156f9f4b328156bcb91a17f2a636.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	372	schtasks.exe	88

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral20/memory/3300-1-0x00000000000B0000-0x00000000003BE000-memory.dmp	dcrat
behavioral20/files/0x000700000002410e-42.dat	dcrat
behavioral20/files/0x000700000001e5bc-80.dat	dcrat
behavioral20/files/0x000300000001e655-102.dat	dcrat
behavioral20/files/0x000500000001dab1-150.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3876	powershell.exe
1156	powershell.exe
4632	powershell.exe
4700	powershell.exe
4040	powershell.exe
3940	powershell.exe
4480	powershell.exe
3432	powershell.exe
676	powershell.exe
4448	powershell.exe
4356	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	231f156f9f4b328156bcb91a17f2a636.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 1 IoCs

pid	Process
432	fontdrvhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\0154351536fc379faee1\\fontdrvhost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\sihost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\0154351536fc379faee1\\dwm.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Windows Media Player\\es-ES\\OfficeClickToRun.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\sihost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\0154351536fc379faee1\\RuntimeBroker.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\0154351536fc379faee1\\smss.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\explorer.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\explorer.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\sihost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\0154351536fc379faee1\\smss.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\0154351536fc379faee1\\dwm.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\3ac54ddf2ad44faa6035cf\\fontdrvhost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\3ac54ddf2ad44faa6035cf\\fontdrvhost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Windows Media Player\\es-ES\\OfficeClickToRun.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\0154351536fc379faee1\\fontdrvhost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\sihost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\0154351536fc379faee1\\RuntimeBroker.exe\""	231f156f9f4b328156bcb91a17f2a636.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\explorer.exe	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCXB549.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_207141104\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_1369421381\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_1369421381\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_1369421381\manifest.fingerprint	msedge.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\RCXA639.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCXAB9C.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCXABAC.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCXB539.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files\Windows Media Player\es-ES\OfficeClickToRun.exe	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\RCXA8CB.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\explorer.exe	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\RCXB2A7.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_1768757503\manifest.fingerprint	msedge.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\RCXB325.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_1768757503\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_102802763\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_102802763\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_207141104\manifest.json	msedge.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\7a0fd90576e088	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files\Windows Media Player\es-ES\e6c9b481da804f	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\RCXA987.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\9e8d7a4ca61bd9	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\66fc9ff0ee96c2	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\RCXA63A.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\66fc9ff0ee96c2	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\OfficeClickToRun.exe	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_1768757503\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_102802763\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4440_102802763\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870975232554605"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	231f156f9f4b328156bcb91a17f2a636.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3218366390-1258052702-4267193707-1000\{71F59E41-CA6D-40A5-86E2-86E7EB568DF0}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
760	schtasks.exe
2052	schtasks.exe
4896	schtasks.exe
4284	schtasks.exe
3540	schtasks.exe
4464	schtasks.exe
980	schtasks.exe
2184	schtasks.exe
4288	schtasks.exe
920	schtasks.exe
836	schtasks.exe
1364	schtasks.exe
3100	schtasks.exe
748	schtasks.exe
908	schtasks.exe
3172	schtasks.exe
884	schtasks.exe
2368	schtasks.exe
1508	schtasks.exe
4432	schtasks.exe
5036	schtasks.exe
3220	schtasks.exe
816	schtasks.exe
1900	schtasks.exe
1224	schtasks.exe
4000	schtasks.exe
464	schtasks.exe
2464	schtasks.exe
556	schtasks.exe
1272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3876	powershell.exe
3876	powershell.exe
4040	powershell.exe
4040	powershell.exe
4356	powershell.exe
4356	powershell.exe
3432	powershell.exe
3432	powershell.exe
4448	powershell.exe
4448	powershell.exe
4480	powershell.exe
4480	powershell.exe
4632	powershell.exe
4632	powershell.exe
4700	powershell.exe
4700	powershell.exe
3940	powershell.exe
3940	powershell.exe
1156	powershell.exe
1156	powershell.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe
3300	231f156f9f4b328156bcb91a17f2a636.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	231f156f9f4b328156bcb91a17f2a636.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	432	fontdrvhost.exe
Token: SeBackupPrivilege	3432	vssvc.exe
Token: SeRestorePrivilege	3432	vssvc.exe
Token: SeAuditPrivilege	3432	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
432	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3876	3300	231f156f9f4b328156bcb91a17f2a636.exe	119
PID 3300 wrote to memory of 3876	3300	231f156f9f4b328156bcb91a17f2a636.exe	119
PID 3300 wrote to memory of 4356	3300	231f156f9f4b328156bcb91a17f2a636.exe	120
PID 3300 wrote to memory of 4356	3300	231f156f9f4b328156bcb91a17f2a636.exe	120
PID 3300 wrote to memory of 4480	3300	231f156f9f4b328156bcb91a17f2a636.exe	121
PID 3300 wrote to memory of 4480	3300	231f156f9f4b328156bcb91a17f2a636.exe	121
PID 3300 wrote to memory of 3940	3300	231f156f9f4b328156bcb91a17f2a636.exe	123
PID 3300 wrote to memory of 3940	3300	231f156f9f4b328156bcb91a17f2a636.exe	123
PID 3300 wrote to memory of 4448	3300	231f156f9f4b328156bcb91a17f2a636.exe	124
PID 3300 wrote to memory of 4448	3300	231f156f9f4b328156bcb91a17f2a636.exe	124
PID 3300 wrote to memory of 4040	3300	231f156f9f4b328156bcb91a17f2a636.exe	126
PID 3300 wrote to memory of 4040	3300	231f156f9f4b328156bcb91a17f2a636.exe	126
PID 3300 wrote to memory of 4700	3300	231f156f9f4b328156bcb91a17f2a636.exe	127
PID 3300 wrote to memory of 4700	3300	231f156f9f4b328156bcb91a17f2a636.exe	127
PID 3300 wrote to memory of 676	3300	231f156f9f4b328156bcb91a17f2a636.exe	128
PID 3300 wrote to memory of 676	3300	231f156f9f4b328156bcb91a17f2a636.exe	128
PID 3300 wrote to memory of 4632	3300	231f156f9f4b328156bcb91a17f2a636.exe	129
PID 3300 wrote to memory of 4632	3300	231f156f9f4b328156bcb91a17f2a636.exe	129
PID 3300 wrote to memory of 1156	3300	231f156f9f4b328156bcb91a17f2a636.exe	130
PID 3300 wrote to memory of 1156	3300	231f156f9f4b328156bcb91a17f2a636.exe	130
PID 3300 wrote to memory of 3432	3300	231f156f9f4b328156bcb91a17f2a636.exe	131
PID 3300 wrote to memory of 3432	3300	231f156f9f4b328156bcb91a17f2a636.exe	131
PID 3300 wrote to memory of 432	3300	231f156f9f4b328156bcb91a17f2a636.exe	141
PID 3300 wrote to memory of 432	3300	231f156f9f4b328156bcb91a17f2a636.exe	141
PID 432 wrote to memory of 4716	432	fontdrvhost.exe	142
PID 432 wrote to memory of 4716	432	fontdrvhost.exe	142
PID 432 wrote to memory of 3596	432	fontdrvhost.exe	143
PID 432 wrote to memory of 3596	432	fontdrvhost.exe	143
PID 432 wrote to memory of 4440	432	fontdrvhost.exe	152
PID 432 wrote to memory of 4440	432	fontdrvhost.exe	152
PID 4440 wrote to memory of 4492	4440	msedge.exe	153
PID 4440 wrote to memory of 4492	4440	msedge.exe	153
PID 4440 wrote to memory of 2376	4440	msedge.exe	154
PID 4440 wrote to memory of 2376	4440	msedge.exe	154
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155
PID 4440 wrote to memory of 748	4440	msedge.exe	155

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\231f156f9f4b328156bcb91a17f2a636.exe
"C:\Users\Admin\AppData\Local\Temp\231f156f9f4b328156bcb91a17f2a636.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\231f156f9f4b328156bcb91a17f2a636.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\0154351536fc379faee1\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\0154351536fc379faee1\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Media Renderer\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\0154351536fc379faee1\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\es-ES\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\0154351536fc379faee1\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3432
- C:\0154351536fc379faee1\fontdrvhost.exe
  "C:\0154351536fc379faee1\fontdrvhost.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:432
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e8ff018-609d-46e7-8c26-f4d708fbbd9b.vbs"
    3⤵
    PID:4716
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94b8bf3b-8985-4cfa-94df-14b7837345fa.vbs"
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:12680/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d8,0x7fff3c78f208,0x7fff3c78f214,0x7fff3c78f220
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1916,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2260,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2564,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
      4⤵
      PID:544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3532,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3564,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2592,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4152,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:2
      4⤵
      PID:288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3772,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3620,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4688,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4928,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5680,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6196,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3504,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6272,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3624,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3616,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5696,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6552,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3692,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6496,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=3592,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6008,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5980,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
      4⤵
      PID:348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6532,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=5304,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4636,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6220,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5472,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
      4⤵
      PID:812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3684,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=868 /prefetch:8
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=6184,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5788,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5416,i,359455068345979612,7835101270243134671,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
      4⤵
      PID:5728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\0154351536fc379faee1\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\0154351536fc379faee1\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\0154351536fc379faee1\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\0154351536fc379faee1\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\0154351536fc379faee1\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\0154351536fc379faee1\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\0154351536fc379faee1\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\0154351536fc379faee1\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\0154351536fc379faee1\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\3ac54ddf2ad44faa6035cf\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\3ac54ddf2ad44faa6035cf\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\es-ES\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\es-ES\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\es-ES\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\0154351536fc379faee1\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\0154351536fc379faee1\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\0154351536fc379faee1\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3300

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery