634fdbe9e73462f6a66c37fc32dbff607ecee354c9edfbc1a99b2f5902a0f077

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	eax فضي وهمي.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	ملف ملغم - Copy.exe

Executes dropped EXE 2 IoCs

pid	Process
4032	CCREATIVE EAX.exe
4236	ملف ملغم - Copy.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
42	discord.com
31	discord.com
32	discord.com
34	discord.com
35	discord.com
39	discord.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCREATIVE EAX.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	msedge.exe
2380	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267319356781200"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{604F5F7D-9839-4A40-A2D2-639AA3D234C0}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{AE40B055-097C-4F05-93FB-C7E9B19A5BE1}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3644	powershell.exe
3644	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeIncreaseQuotaPrivilege	3644	powershell.exe
Token: SeSecurityPrivilege	3644	powershell.exe
Token: SeTakeOwnershipPrivilege	3644	powershell.exe
Token: SeLoadDriverPrivilege	3644	powershell.exe
Token: SeSystemProfilePrivilege	3644	powershell.exe
Token: SeSystemtimePrivilege	3644	powershell.exe
Token: SeProfSingleProcessPrivilege	3644	powershell.exe
Token: SeIncBasePriorityPrivilege	3644	powershell.exe
Token: SeCreatePagefilePrivilege	3644	powershell.exe
Token: SeBackupPrivilege	3644	powershell.exe
Token: SeRestorePrivilege	3644	powershell.exe
Token: SeShutdownPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeSystemEnvironmentPrivilege	3644	powershell.exe
Token: SeRemoteShutdownPrivilege	3644	powershell.exe
Token: SeUndockPrivilege	3644	powershell.exe
Token: SeManageVolumePrivilege	3644	powershell.exe
Token: 33	3644	powershell.exe
Token: 34	3644	powershell.exe
Token: 35	3644	powershell.exe
Token: 36	3644	powershell.exe
Token: SeDebugPrivilege	4236	ملف ملغم - Copy.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4032	CCREATIVE EAX.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 3644	4752	eax فضي وهمي.exe	82
PID 4752 wrote to memory of 4032	4752	eax فضي وهمي.exe	85
PID 4752 wrote to memory of 4236	4752	eax فضي وهمي.exe	86
PID 4236 wrote to memory of 4164	4236	ملف ملغم - Copy.exe	87
PID 4032 wrote to memory of 4112	4032	CCREATIVE EAX.exe	89
PID 4112 wrote to memory of 4944	4112	msedge.exe	90
PID 4112 wrote to memory of 4712	4112	msedge.exe	91
PID 4112 wrote to memory of 3428	4112	msedge.exe	92
PID 4112 wrote to memory of 3428	4112	msedge.exe	92
PID 4112 wrote to memory of 3428	4112	msedge.exe	92
PID 4112 wrote to memory of 1060	4112	msedge.exe	93
PID 4112 wrote to memory of 1060	4112	msedge.exe	93
PID 4112 wrote to memory of 5540	4112	msedge.exe	95
PID 4112 wrote to memory of 5540	4112	msedge.exe	95
PID 4112 wrote to memory of 5540	4112	msedge.exe	95
PID 4112 wrote to memory of 5072	4112	msedge.exe	96
PID 4112 wrote to memory of 5072	4112	msedge.exe	96
PID 4112 wrote to memory of 5072	4112	msedge.exe	96
PID 4112 wrote to memory of 2312	4112	msedge.exe	102
PID 4112 wrote to memory of 2312	4112	msedge.exe	102
PID 4112 wrote to memory of 2312	4112	msedge.exe	102
PID 4112 wrote to memory of 4380	4112	msedge.exe	105
PID 4112 wrote to memory of 3868	4112	msedge.exe	106
PID 4112 wrote to memory of 3868	4112	msedge.exe	106
PID 4112 wrote to memory of 4960	4112	msedge.exe	108
PID 4960 wrote to memory of 5256	4960	msedge.exe	109
PID 4960 wrote to memory of 2380	4960	msedge.exe	111
PID 4960 wrote to memory of 1928	4960	msedge.exe	112
PID 4960 wrote to memory of 1928	4960	msedge.exe	112
PID 4960 wrote to memory of 1928	4960	msedge.exe	112
PID 4960 wrote to memory of 3164	4960	msedge.exe	113
PID 4960 wrote to memory of 3164	4960	msedge.exe	113
PID 4960 wrote to memory of 5864	4960	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\eax فضي وهمي.exe
"C:\Users\Admin\AppData\Local\Temp\eax فضي وهمي.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CCREATIVE EAX.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3644
- C:\Users\Admin\AppData\Local\Temp\CCREATIVE EAX.exe
  "C:\Users\Admin\AppData\Local\Temp\CCREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/nzf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7fff41b3c188,0x7fff41b3c194,0x7fff41b3c1a0
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,6709804706433469001,9921561081962148142,524288 --field-trial-handle=2248,i,9022268139457998295,14664237768690292274,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
      4⤵
      System Time Discovery
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,3471410646929966370,3918339934131827484,262144 --field-trial-handle=2248,i,9022268139457998295,14664237768690292274,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,6352532705104044395,4335392245482064616,524288 --field-trial-handle=2248,i,9022268139457998295,14664237768690292274,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,3987833632763858953,10501148744084939295,2097152 --field-trial-handle=2248,i,9022268139457998295,14664237768690292274,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,16879395063851922229,11611569429498757153,2097152 --field-trial-handle=2248,i,9022268139457998295,14664237768690292274,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,2052329243680332211,8851081087571761000,2097152 --field-trial-handle=2248,i,9022268139457998295,14664237768690292274,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,3268911413651739987,11952897622615305918,524288 --field-trial-handle=2248,i,9022268139457998295,14664237768690292274,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
      4⤵
      Modifies registry class
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,7774617468951355938,2553607961734053848,524288 --field-trial-handle=2248,i,9022268139457998295,14664237768690292274,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fff41b3c188,0x7fff41b3c194,0x7fff41b3c1a0
        5⤵
        
        PID:5256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,18160810074822426863,14687533916388658962,524288 --field-trial-handle=2416,i,17172843482055999993,17323536257465390473,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:2380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,1289045710910624093,13146641956293899398,262144 --field-trial-handle=2416,i,17172843482055999993,17323536257465390473,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
        5⤵
        
        PID:1928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,3125623478817884111,2984307753176065190,524288 --field-trial-handle=2416,i,17172843482055999993,17323536257465390473,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
        5⤵
        
        PID:3164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,16243919919001900087,5854805312843731844,524288 --field-trial-handle=2416,i,17172843482055999993,17323536257465390473,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
        5⤵
        
        PID:5484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,16243919919001900087,5854805312843731844,524288 --field-trial-handle=2416,i,17172843482055999993,17323536257465390473,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
        5⤵
        
        PID:5864
- C:\Users\Admin\AppData\Local\Temp\ملف ملغم - Copy.exe
  "C:\Users\Admin\AppData\Local\Temp\ملف ملغم - Copy.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "ملف ملغم - Copy" /tr "C:\Users\Admin\AppData\Roaming\ملف ملغم - Copy.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery