stealc | be2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	SvcHostAnalyzer.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	rkhuba.exe
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	xbe2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a.exe

Executes dropped EXE 20 IoCs

pid	Process
1552	crkhost.exe
4904	nctsrn.exe
4940	cbuttc.exe
4072	wmiprv.exe
3884	uigreax.exe
2832	rkhuba.exe
5368	SvcHostAnalyzer.exe
4376	FUCKFLIX NETFLIX V2.1.exe
6100	WinUpdateHelper.exe
2368	wmiprv.exe
5792	EmbeddedDriverService.sys
2952	svchost.exe
1904	FUCKFLIX NETFLIX V2.1.exe
5240	winhost.exe
3732	zgymn.exe
112	zgymn.exe
1912	zhqseq.exe
5032	zhqseq.exe
5400	zhqseq.exe
6108	zhqseq.exe

Loads dropped DLL 32 IoCs

pid	Process
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe
1904	FUCKFLIX NETFLIX V2.1.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security = "C:\\Users\\Admin\\AppData\\Roaming\\wmiprv.exe"	wmiprv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ypahz = "C:\\ProgramData\\zgymn.exe"	rkhuba.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	zhqseq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	zhqseq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	zhqseq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security = "C:\\Users\\Admin\\AppData\\Roaming\\wmiprv.exe"	wmiprv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	uigreax.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_1076862788\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_787436334\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_1076862788\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_787436334\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_948646468\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_948646468\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_787436334\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_1076862788\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_787436334\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_948646468\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6004_280180140\_locales\be\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3412	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cbuttc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cbuttc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227620474466782"	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\WasEverActivated = "1"	sihost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{F16AF1B6-240A-49AB-97C0-8AE98E6D4975}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{DBFA8232-7463-457D-9015-558CE3427519}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xbe2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	rkhuba.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4072	wmiprv.exe
4072	wmiprv.exe
6100	WinUpdateHelper.exe
6100	WinUpdateHelper.exe
2368	wmiprv.exe
2368	wmiprv.exe
4940	cbuttc.exe
4940	cbuttc.exe
5296	msedge.exe
5296	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
5368	SvcHostAnalyzer.exe
5368	SvcHostAnalyzer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe
6004	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	5368	SvcHostAnalyzer.exe
Token: SeLoadDriverPrivilege	5368	SvcHostAnalyzer.exe
Token: SeDebugPrivilege	4072	wmiprv.exe
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeDebugPrivilege	2368	wmiprv.exe
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeDebugPrivilege	1904	FUCKFLIX NETFLIX V2.1.exe
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE
Token: SeCreatePagefilePrivilege	3260	Explorer.EXE
Token: SeShutdownPrivilege	3260	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6004	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3872	Conhost.exe
1584	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1552	4968	xbe2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a.exe	84
PID 4968 wrote to memory of 4904	4968	xbe2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a.exe	85
PID 4968 wrote to memory of 4940	4968	xbe2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a.exe	86
PID 4968 wrote to memory of 4072	4968	xbe2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a.exe	87
PID 4968 wrote to memory of 3884	4968	xbe2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a.exe	89
PID 4968 wrote to memory of 2832	4968	xbe2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a.exe	90
PID 4968 wrote to memory of 4376	4968	xbe2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a.exe	93
PID 4072 wrote to memory of 3260	4072	wmiprv.exe	55
PID 3260 wrote to memory of 5476	3260	Explorer.EXE
PID 3260 wrote to memory of 1704	3260	Explorer.EXE
PID 6100 wrote to memory of 1060	6100	WinUpdateHelper.exe	51
PID 6100 wrote to memory of 2940	6100	WinUpdateHelper.exe	53
PID 6100 wrote to memory of 3260	6100	WinUpdateHelper.exe	55
PID 6100 wrote to memory of 3800	6100	WinUpdateHelper.exe	60
PID 6100 wrote to memory of 3588	6100	WinUpdateHelper.exe	62
PID 6100 wrote to memory of 5900	6100	WinUpdateHelper.exe	65
PID 6100 wrote to memory of 5476	6100	WinUpdateHelper.exe
PID 6100 wrote to memory of 1704	6100	WinUpdateHelper.exe
PID 6100 wrote to memory of 3872	6100	WinUpdateHelper.exe	95
PID 6100 wrote to memory of 1584	6100	WinUpdateHelper.exe	96
PID 2368 wrote to memory of 3260	2368	wmiprv.exe	55
PID 4940 wrote to memory of 5304	4940	cbuttc.exe	100
PID 4940 wrote to memory of 5304	4940	cbuttc.exe	100
PID 3260 wrote to memory of 5884	3260	Explorer.EXE
PID 3260 wrote to memory of 816	3260	Explorer.EXE
PID 4940 wrote to memory of 5428	4940	cbuttc.exe	105
PID 4940 wrote to memory of 5428	4940	cbuttc.exe	105
PID 4376 wrote to memory of 1904	4376	FUCKFLIX NETFLIX V2.1.exe	107
PID 2952 wrote to memory of 2192	2952	svchost.exe	110
PID 3260 wrote to memory of 1196	3260	Explorer.EXE
PID 2832 wrote to memory of 3732	2832	rkhuba.exe	114
PID 1904 wrote to memory of 4196	1904	FUCKFLIX NETFLIX V2.1.exe	115
PID 2952 wrote to memory of 5584	2952	svchost.exe	116
PID 3260 wrote to memory of 2400	3260	Explorer.EXE
PID 1904 wrote to memory of 6004	1904	FUCKFLIX NETFLIX V2.1.exe	121
PID 6004 wrote to memory of 4204	6004	msedge.exe	122
PID 6004 wrote to memory of 3412	6004	msedge.exe	124
PID 6004 wrote to memory of 4996	6004	msedge.exe	125
PID 6004 wrote to memory of 4996	6004	msedge.exe	125
PID 6004 wrote to memory of 4996	6004	msedge.exe	125
PID 6004 wrote to memory of 2360	6004	msedge.exe	126
PID 6004 wrote to memory of 2360	6004	msedge.exe	126
PID 6004 wrote to memory of 4024	6004	msedge.exe	128
PID 6004 wrote to memory of 4024	6004	msedge.exe	128
PID 6004 wrote to memory of 4648	6004	msedge.exe	129
PID 6004 wrote to memory of 4024	6004	msedge.exe	128
PID 6004 wrote to memory of 4648	6004	msedge.exe	129
PID 6004 wrote to memory of 4648	6004	msedge.exe	129
PID 6004 wrote to memory of 1476	6004	msedge.exe	133
PID 6004 wrote to memory of 1476	6004	msedge.exe	133
PID 6004 wrote to memory of 5628	6004	msedge.exe	134
PID 6004 wrote to memory of 5628	6004	msedge.exe	134
PID 6004 wrote to memory of 468	6004	msedge.exe	136
PID 3260 wrote to memory of 1992	3260	Explorer.EXE
PID 6004 wrote to memory of 2656	6004	msedge.exe	139
PID 6004 wrote to memory of 2656	6004	msedge.exe	139
PID 6004 wrote to memory of 2656	6004	msedge.exe	139
PID 6004 wrote to memory of 4344	6004	msedge.exe	140
PID 6004 wrote to memory of 4344	6004	msedge.exe	140
PID 6004 wrote to memory of 4344	6004	msedge.exe	140
PID 6004 wrote to memory of 5752	6004	msedge.exe	141
PID 6004 wrote to memory of 5752	6004	msedge.exe	141
PID 6004 wrote to memory of 4980	6004	msedge.exe	142
PID 6004 wrote to memory of 3576	6004	msedge.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Modifies registry class
PID:1060

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2940

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Temp\xbe2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a.exe
  "C:\Users\Admin\AppData\Local\Temp\xbe2ce3dfb4cb37cfaaced0488cebb01fa066cdb7dc702424f160be92a6501f1a.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Users\Admin\AppData\Roaming\crkhost.exe
    "C:\Users\Admin\AppData\Roaming\crkhost.exe"
    3⤵
    - Executes dropped EXE
    PID:1552
- - C:\Users\Admin\AppData\Roaming\nctsrn.exe
    "C:\Users\Admin\AppData\Roaming\nctsrn.exe"
    3⤵
    - Executes dropped EXE
    PID:4904
- - C:\Users\Admin\AppData\Roaming\cbuttc.exe
    "C:\Users\Admin\AppData\Roaming\cbuttc.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5428
- - C:\Users\Admin\AppData\Roaming\wmiprv.exe
    "C:\Users\Admin\AppData\Roaming\wmiprv.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4072
- - C:\Users\Admin\AppData\Roaming\uigreax.exe
    "C:\Users\Admin\AppData\Roaming\uigreax.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3884
- - C:\Users\Admin\AppData\Roaming\rkhuba.exe
    "C:\Users\Admin\AppData\Roaming\rkhuba.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\ProgramData\zgymn.exe
      "C:\ProgramData\zgymn.exe"
      4⤵
      Executes dropped EXE
      PID:3732
- - C:\Users\Admin\AppData\Local\Temp\FUCKFLIX NETFLIX V2.1.exe
    "C:\Users\Admin\AppData\Local\Temp\FUCKFLIX NETFLIX V2.1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\FUCKFLIX NETFLIX V2.1.exe
      "C:\Users\Admin\AppData\Local\Temp\FUCKFLIX NETFLIX V2.1.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/4g22RWGw3Nc?list=RDZAluWGh-u_M&t=3
        5⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:6004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2bc,0x2c0,0x2c4,0x2b8,0x354,0x7fff91ecc188,0x7fff91ecc194,0x7fff91ecc1a0
        6⤵
        
        PID:4204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,12322208216150975999,14703119807481296027,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:3412
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,5023969613808926760,11441370262412382492,262144 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
        6⤵
        
        PID:4996
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,2271234678268717663,10729826374304089250,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
        6⤵
        
        PID:2360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,17360523469882637741,11079718692607375010,2097152 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        6⤵
        
        PID:4024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6887528923269246516,16168740419631217723,2097152 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
        6⤵
        
        PID:4648
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,16554011086956140740,8713077859802850713,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
        6⤵
        
        PID:1476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,2891506634191145029,11802647163931606770,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
        6⤵
        
        PID:5628
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,18194056429890294287,10244029017272862965,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
        6⤵
        
        PID:5284
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,18194056429890294287,10244029017272862965,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
        6⤵
        
        PID:468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6088,i,10933763064174980599,6381790532598710663,2097152 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
        6⤵
        
        PID:2656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3512,i,7850403523073034550,5753080644324839568,2097152 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
        6⤵
        
        PID:4344
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,11326052842649925611,18247248824566817034,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:8
        6⤵
        
        PID:5752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,1405714569119276359,4896867434191072302,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
        6⤵
        Modifies registry class
        
        PID:4980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6624,i,14081212012154247996,15799655682843596226,2097152 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
        6⤵
        
        PID:3576
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,4355077273296504368,2365052686339166871,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
        6⤵
        
        PID:3860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,18445993301250023517,16752868706316850201,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
        6⤵
        
        PID:4564
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,17764441563507294542,8450628487262179836,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
        6⤵
        
        PID:4772
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,8960080969157506148,13674598163936533211,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
        6⤵
        
        PID:5744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,12421318250512546884,82527596581070864,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
        6⤵
        
        PID:5496
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,7371326860843015910,8049921402673538439,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
        6⤵
        
        PID:2552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,3362153267326324573,14819172803852305797,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
        6⤵
        
        PID:4252
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,16753773489282100179,3044233143427445455,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
        6⤵
        
        PID:3332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7160,i,15922128957063843154,14599952578063153068,262144 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=848 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5296
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,11245873467289085515,2237369624644983520,524288 --field-trial-handle=2168,i,13124873210198044431,6577968399685666970,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
        6⤵
        
        PID:228

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3800

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3588

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5900

C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
"C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
"C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6100

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3872

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:1584

C:\Users\Admin\AppData\Roaming\wmiprv.exe
C:\Users\Admin\AppData\Roaming\wmiprv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
- Executes dropped EXE
PID:5792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5808

C:\Users\Admin\Pictures\svchost.exe
C:\Users\Admin\Pictures\svchost.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /query /tn "Google Updater Task"
  2⤵
  PID:2192
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Google Updater Task" /tr "C:\Users\Admin\AppData\Roaming\zhqseq.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3520

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
- Executes dropped EXE
PID:5240

C:\ProgramData\zgymn.exe
C:\ProgramData\zgymn.exe
1⤵
- Executes dropped EXE
PID:112

C:\Users\Admin\AppData\Roaming\zhqseq.exe
C:\Users\Admin\AppData\Roaming\zhqseq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2416

C:\Users\Admin\AppData\Roaming\zhqseq.exe
C:\Users\Admin\AppData\Roaming\zhqseq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5032

C:\Users\Admin\AppData\Roaming\zhqseq.exe
C:\Users\Admin\AppData\Roaming\zhqseq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5400

C:\Users\Admin\AppData\Roaming\zhqseq.exe
C:\Users\Admin\AppData\Roaming\zhqseq.exe
1⤵
- Executes dropped EXE
PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery