6d73237ebecf295572dec92873ad228436089dcddf90759f9dd62e027e8d2710

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys"	mbamservice.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mbamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mbamservice.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service"	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp

Installs a root certificate to the trusted certificate store 1 TTPs 2 IoCs

A root certificate was added to the trusted certificate store using CertUtil.

defense_evasion

Install Root Certificate

pid	Process
4516	certutil.exe
6308	certutil.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\G:	mbamservice.exe
File opened (read-only)	\??\J:	mbamservice.exe
File opened (read-only)	\??\L:	mbamservice.exe
File opened (read-only)	\??\M:	mbamservice.exe
File opened (read-only)	\??\S:	mbamservice.exe
File opened (read-only)	\??\V:	mbamservice.exe
File opened (read-only)	\??\W:	mbamservice.exe
File opened (read-only)	\??\Z:	mbamservice.exe
File opened (read-only)	\??\P:	mbamservice.exe
File opened (read-only)	\??\Q:	mbamservice.exe
File opened (read-only)	\??\A:	mbamservice.exe
File opened (read-only)	\??\H:	mbamservice.exe
File opened (read-only)	\??\I:	mbamservice.exe
File opened (read-only)	\??\K:	mbamservice.exe
File opened (read-only)	\??\R:	mbamservice.exe
File opened (read-only)	\??\U:	mbamservice.exe
File opened (read-only)	\??\B:	mbamservice.exe
File opened (read-only)	\??\D:	mbamservice.exe
File opened (read-only)	\??\N:	mbamservice.exe
File opened (read-only)	\??\T:	mbamservice.exe
File opened (read-only)	\??\X:	mbamservice.exe
File opened (read-only)	\??\Y:	mbamservice.exe
File opened (read-only)	\??\O:	mbamservice.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7BD5521448F9309F5CEB0C75890FFABC	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7BD5521448F9309F5CEB0C75890FFABC	mbamservice.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CA4458E7366E94A3C3A9C1FE548B6D21_C2C3D990B393462F0B24251F41DF0EF5	mbamservice.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CA4458E7366E94A3C3A9C1FE548B6D21_C2C3D990B393462F0B24251F41DF0EF5	mbamservice.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-2MTS9.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qml\is-C87UA.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qml\is-4COEH.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-CLMRI.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-1KNE9.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-6INS8.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-R2DQ0.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.tmf	mbamservice.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2\is-EHO2E.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\is-T0DRL.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-SO8MA.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-1IRN7.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf	mbamservice.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-GLTPJ.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-IC5G7.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-AQ0AD.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf	mbamservice.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-21EVD.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-NP036.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\iconengines\is-ARRA7.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat\is-F1A4C.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-T0P5Q.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-SMPD7.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-A07G0.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-D4TOT.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-5Q12N.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\folderlistmodel\is-I1NA5.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2\is-K7CEU.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\is-NU5CD.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2\is-GN4V0.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-C16T9.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-S8QI9.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-GBE4C.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\Private\is-0MJFL.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-JK37Q.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-EGAV2.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-089AS.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-P819H.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-SL092.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-RDSTJ.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sdk\mbam.cat	mbamservice.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-124Q2.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Layouts\is-FCAQE.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-I3J3B.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-TB4IC.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-901UK.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-AOBQQ.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-F8Q94.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-TFPO5.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\is-P27QM.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qml\is-SDSDC.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-D4FIC.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-N8L88.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-DIDKH.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sys	mbamservice.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.inf	mbamservice.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.tmf	mbamservice.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\is-VPVR6.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\is-UAU0A.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-APLN7.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-56PK7.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-T7M0M.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\is-KC79U.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\is-OCNOQ.tmp	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	mbamservice.exe
File opened for modification	C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Executes dropped EXE 10 IoCs

pid	Process
3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
6796	mbamservice.exe
2580	MBAMService.exe
5304	mbamservice.exe
6976	mbamtray.exe
1840	mbae64.sys
1360	mbam.exe
4592	mbam.exe
6196	mbam.exe
4892	MBAMWsc.exe

Loads dropped DLL 64 IoCs

pid	Process
3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
5304	mbamservice.exe
5304	mbamservice.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
1360	mbam.exe
1360	mbam.exe
1360	mbam.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 6 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc250f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	mbamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df020000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	mbamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a80300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc32000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	mbamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	mbamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a80300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	mbamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df0030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4740f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	mbamservice.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbamtray.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1784	msedge.exe
6480	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5684-0-0x0000000000400000-0x0000000000445000-memory.dmp	innosetup
behavioral2/memory/5684-41-0x0000000000400000-0x0000000000445000-memory.dmp	innosetup
behavioral2/memory/5684-2605-0x0000000000400000-0x0000000000445000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mbamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mbamservice.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

defense_evasion spyware trojan

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000"	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000"	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mbamservice.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\MY	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mbamservice.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277454329738003"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mbamservice.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mbamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	mbamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	mbamservice.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\Version	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0101B90-FD0B-40CF-90E4-33650F09A80F}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCF0F42-EF8F-4450-BA68-42B61F594B2F}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2650A9C4-A53C-4BEF-B766-7405B4D5562B}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17A7CC72-3288-442A-ABE8-F8E049B3BE83}\ = "IUpdateControllerV6"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A34647B-D9A8-40D9-B563-F9461E98030E}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB30855D-36DF-41BD-9EEE-03BA7E8E70B7}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3498D9E4-6476-4AC0-B53A-75BC9955EF37}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3641B831-731C-4963-B50B-D84902285C26}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A23C190D-C714-42C7-BDBB-F4E1DE65AF27}\1.0\HELPDIR	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09F245DA-55E7-451E-BDF3-4EE44637DFF1}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77AD284A-4686-413D-AA76-BDFC1DF52A19}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78E69E6F-EC12-4B84-8431-1D68572C7A61}\ = "_IScanControllerEvents"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00A73BC0-754E-44E1-B190-D59E187A5EA1}\ = "ICleanControllerV2"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F12E228B-821D-4093-B2E0-7F3E169A925A}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620A01DD-16D2-4A83-B02C-E29BE38B3029}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8B05F69B-4F9B-4FD3-A491-16153F999E00}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02143C0F-1656-4B2E-95E7-EA8178A29E2E}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83D0C30B-ECF4-40C5-80EC-21BB47F898A9}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2846D47E-9B85-4836-B883-6A7B493E2D6A}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1D8E799-D5A2-45B4-9524-067144A201E4}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{616E9BE3-358B-4C06-8AAB-0ACF8D089931}\TypeLib\ = "{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{106E3995-72F9-458A-A317-9AFF9E45A1F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}\1.0\HELPDIR	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19184D37-6938-4F54-BAFD-3240F0FA75E6}	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{995A8F3B-6B5F-4773-898A-862D50142B4C}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A34647B-D9A8-40D9-B563-F9461E98030E}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.RTPController\CurVer	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DB82CDC6-F12A-4156-8DBF-EC7465B9C0B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\Version\ = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE35F2CA-6335-49BA-8E86-F6E246CFCEA6}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5201562-332D-4385-87E7-2BB41B1694AA}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A10434E2-CAA7-48C4-9770-E9F215C51ECC}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1A173904-D20F-4872-93D5-CBC1336AE0D6}\ = "_IRTPControllerEventsV2"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6CE18DD5-2BD7-4844-B9AD-DF6A995750A1}\TypeLib\Version = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A574BA8-3535-41F9-AB73-FA93F8A7DC3B}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CE94D34-A1E4-4FA8-BEDC-6A32683B85F5}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\ = "RTPController Class"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.UpdateController.1\CLSID	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106E3995-72F9-458A-A317-9AFF9E45A1F0}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5091804-600E-4226-BF28-80ABFDF4AFAB}\ = "IScanner"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81541635-736E-4460-81AA-86118F313CD5}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}\1.0\ = "LicenseControllerCOMLib"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F275D775-3A22-4C5A-B9AD-6FE8008304D0}\ProxyStubClsid32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C871BA6-4662-4E17-ABF4-3B2276FC0FF4}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\ = "Scanner Class"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A9108FB-A377-47EC-96E3-3CB8B1FB7272}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD3CFEBD-3B8E-4651-BB7C-537D1F03E59C}\TypeLib	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6357A98F-CE03-4C67-9410-00907FB21BC7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21EA9E3C-6507-4725-8F4F-ED4DDDE7A709}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{61DF8ACF-EC61-4D69-A543-20EA450E1A84}\ = "ISPControllerV5"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\Version\ = "1.0"	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1F1EB48-7803-4D84-B07F-255FE87083F4}\ProxyStubClsid32	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C710FA9-862A-40CF-9F54-063EF8FC8438}\TypeLib	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2446F405-83F0-460F-B837-F04540BB330C}	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7DD05E6E-FF07-4CD3-A7BA-200BEC812A5C}\ = "IAEControllerV5"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DB82CDC6-F12A-4156-8DBF-EC7465B9C0B9}\TypeLib\Version = "1.0"	mbamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{616E9BE3-358B-4C06-8AAB-0ACF8D089931}\TypeLib\Version = "1.0"	mbamservice.exe

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	mbamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	mbamservice.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
6976	mbamtray.exe
1360	mbam.exe
4592	mbam.exe
6196	mbam.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
5304	mbamservice.exe
6976	mbamtray.exe
6976	mbamtray.exe
5304	mbamservice.exe
5304	mbamservice.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1360	mbam.exe

Suspicious behavior: LoadsDriver 9 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: 33	6796	mbamservice.exe
Token: SeIncBasePriorityPrivilege	6796	mbamservice.exe
Token: 33	2580	MBAMService.exe
Token: SeIncBasePriorityPrivilege	2580	MBAMService.exe
Token: 33	5304	mbamservice.exe
Token: SeIncBasePriorityPrivilege	5304	mbamservice.exe
Token: SeRestorePrivilege	5304	mbamservice.exe
Token: SeTakeOwnershipPrivilege	5304	mbamservice.exe
Token: SeRestorePrivilege	5304	mbamservice.exe
Token: SeTakeOwnershipPrivilege	5304	mbamservice.exe
Token: SeRestorePrivilege	5304	mbamservice.exe
Token: SeBackupPrivilege	5304	mbamservice.exe
Token: SeAssignPrimaryTokenPrivilege	5304	mbamservice.exe
Token: SeIncreaseQuotaPrivilege	5304	mbamservice.exe
Token: SeSecurityPrivilege	5304	mbamservice.exe
Token: SeTakeOwnershipPrivilege	5304	mbamservice.exe
Token: SeLoadDriverPrivilege	5304	mbamservice.exe
Token: SeSystemtimePrivilege	5304	mbamservice.exe
Token: SeBackupPrivilege	5304	mbamservice.exe
Token: SeRestorePrivilege	5304	mbamservice.exe
Token: SeShutdownPrivilege	5304	mbamservice.exe
Token: SeSystemEnvironmentPrivilege	5304	mbamservice.exe
Token: SeUndockPrivilege	5304	mbamservice.exe
Token: SeManageVolumePrivilege	5304	mbamservice.exe
Token: SeShutdownPrivilege	1360	mbam.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
1988	msedge.exe
3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
1988	msedge.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
1360	mbam.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
6976	mbamtray.exe
1360	mbam.exe
1360	mbam.exe
1360	mbam.exe
1360	mbam.exe
1360	mbam.exe
4592	mbam.exe
6196	mbam.exe
7120	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 3288	5684	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.exe	88
PID 3288 wrote to memory of 1988	3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp	89
PID 1988 wrote to memory of 4448	1988	msedge.exe	90
PID 1988 wrote to memory of 1576	1988	msedge.exe	92
PID 1988 wrote to memory of 1784	1988	msedge.exe	93
PID 1988 wrote to memory of 1576	1988	msedge.exe	92
PID 1988 wrote to memory of 1576	1988	msedge.exe	92
PID 1988 wrote to memory of 3400	1988	msedge.exe	94
PID 1988 wrote to memory of 3400	1988	msedge.exe	94
PID 1988 wrote to memory of 1728	1988	msedge.exe	95
PID 1988 wrote to memory of 1728	1988	msedge.exe	95
PID 1988 wrote to memory of 1728	1988	msedge.exe	95
PID 1988 wrote to memory of 1192	1988	msedge.exe	96
PID 1988 wrote to memory of 1192	1988	msedge.exe	96
PID 1988 wrote to memory of 1192	1988	msedge.exe	96
PID 1988 wrote to memory of 3212	1988	msedge.exe	97
PID 1988 wrote to memory of 3212	1988	msedge.exe	97
PID 1988 wrote to memory of 3212	1988	msedge.exe	97
PID 1988 wrote to memory of 3012	1988	msedge.exe	98
PID 1988 wrote to memory of 3012	1988	msedge.exe	98
PID 1988 wrote to memory of 3012	1988	msedge.exe	98
PID 1988 wrote to memory of 4744	1988	msedge.exe	99
PID 1988 wrote to memory of 4744	1988	msedge.exe	99
PID 1988 wrote to memory of 1240	1988	msedge.exe	101
PID 1988 wrote to memory of 5028	1988	msedge.exe	102
PID 1988 wrote to memory of 1240	1988	msedge.exe	101
PID 1988 wrote to memory of 5028	1988	msedge.exe	102
PID 1988 wrote to memory of 3724	1988	msedge.exe	104
PID 3288 wrote to memory of 5284	3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp	105
PID 1988 wrote to memory of 2428	1988	msedge.exe	106
PID 1988 wrote to memory of 2428	1988	msedge.exe	106
PID 1988 wrote to memory of 2428	1988	msedge.exe	106
PID 1988 wrote to memory of 4748	1988	msedge.exe	107
PID 1988 wrote to memory of 4748	1988	msedge.exe	107
PID 3288 wrote to memory of 4892	3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp	117
PID 1988 wrote to memory of 1300	1988	msedge.exe	111
PID 1988 wrote to memory of 1300	1988	msedge.exe	111
PID 1988 wrote to memory of 1300	1988	msedge.exe	111
PID 1988 wrote to memory of 2260	1988	msedge.exe	113
PID 1988 wrote to memory of 2260	1988	msedge.exe	113
PID 3288 wrote to memory of 1388	3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp	115
PID 1988 wrote to memory of 1636	1988	msedge.exe	116
PID 1988 wrote to memory of 1636	1988	msedge.exe	116
PID 1988 wrote to memory of 1636	1988	msedge.exe	116
PID 3288 wrote to memory of 4892	3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp	117
PID 1988 wrote to memory of 3024	1988	msedge.exe	118
PID 1988 wrote to memory of 3024	1988	msedge.exe	118
PID 1988 wrote to memory of 3024	1988	msedge.exe	118
PID 3288 wrote to memory of 2556	3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp	119
PID 1988 wrote to memory of 4604	1988	msedge.exe	120
PID 1988 wrote to memory of 4604	1988	msedge.exe	120
PID 1988 wrote to memory of 4604	1988	msedge.exe	120
PID 1988 wrote to memory of 2928	1988	msedge.exe	121
PID 1988 wrote to memory of 6140	1988	msedge.exe	122
PID 1988 wrote to memory of 4224	1988	msedge.exe	123
PID 3288 wrote to memory of 2812	3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp	124
PID 1988 wrote to memory of 4432	1988	msedge.exe	125
PID 1988 wrote to memory of 4432	1988	msedge.exe	125
PID 1988 wrote to memory of 4432	1988	msedge.exe	125
PID 3288 wrote to memory of 1280	3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp	126
PID 1988 wrote to memory of 1944	1988	msedge.exe	127
PID 1988 wrote to memory of 1944	1988	msedge.exe	127
PID 1988 wrote to memory of 1944	1988	msedge.exe	127
PID 3288 wrote to memory of 2732	3288	mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp	128

C:\Users\Admin\AppData\Local\Temp\mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.exe
"C:\Users\Admin\AppData\Local\Temp\mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Users\Admin\AppData\Local\Temp\is-767H8.tmp\mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-767H8.tmp\mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.tmp" /SL5="$4020E,77953186,239616,C:\Users\Admin\AppData\Local\Temp\mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7589.exe"
  2⤵
  - Drops file in Drivers directory
  - Impair Defenses: Safe Mode Boot
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/eula/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0xac,0x2f4,0x2f8,0xa8,0x300,0x7ffdd787c188,0x7ffdd787c194,0x7ffdd787c1a0
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1968,i,13127048721735526067,11043843934899900457,262144 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,11128460196931704753,18115118178862412543,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
      4⤵
      System Time Discovery
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,8192137720844020344,9796376017350500712,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,3656295988371671312,16877377965210615349,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,9030103226595097816,14071931488843362904,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,16342420158514145029,8838290243000414024,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,15638473964564088694,16708406288943081555,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:9
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,15162857410189143199,16537280336472907105,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,11475734815771831156,2647132715476308197,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,16319626935212919145,12988510007188448987,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,14317702257316129481,3624332664056138873,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,14317702257316129481,3624332664056138873,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6180,i,558856595356740039,16692308218817340538,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,2163629162469784477,6581471456080327038,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7164,i,2752196695214417648,11486790272265750302,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,7125520383693054441,13756316475781135651,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:14
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6620,i,540381297901770995,18213312987749367599,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7540,i,13029748197885427924,8882316865936520099,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5976,i,12450933095375690442,13644321779090576577,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:1
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,8636598222361549265,3580371514070700844,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1212,i,16765253356059324591,16047863853471291190,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:14
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,7946751280710910370,6563689972609180242,524288 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:14
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6012,i,14787528446850588796,4196622247018370000,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=1276,i,7850042289293710837,3108890997005452228,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:1
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6876,i,6639373871787328850,15465825060042405402,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5376,i,17524411152293405741,6660382979075132633,2097152 --field-trial-handle=2456,i,7664398555755667950,5109866248721704083,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:6500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      PID:7144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffdd787c188,0x7ffdd787c194,0x7ffdd787c1a0
        5⤵
        
        PID:6152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,17816951139271939267,17584989914312932954,262144 --field-trial-handle=2672,i,4228428223198884130,6699847346266685393,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:2
        5⤵
        
        PID:6852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,1887313285451542675,2447693956419956123,524288 --field-trial-handle=2672,i,4228428223198884130,6699847346266685393,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,5765806844834197441,5610730740301791295,524288 --field-trial-handle=2672,i,4228428223198884130,6699847346266685393,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:13
        5⤵
        
        PID:6792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,12579705777174813345,7443590521908801585,524288 --field-trial-handle=2672,i,4228428223198884130,6699847346266685393,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
        5⤵
        
        PID:6864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,12579705777174813345,7443590521908801585,524288 --field-trial-handle=2672,i,4228428223198884130,6699847346266685393,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
        5⤵
        
        PID:5728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,1268387140275541570,17020680924164674856,524288 --field-trial-handle=2672,i,4228428223198884130,6699847346266685393,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:14
        5⤵
        
        PID:5188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,10121714156579766501,3902098028775645715,524288 --field-trial-handle=2672,i,4228428223198884130,6699847346266685393,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
        5⤵
        
        PID:3752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,18274690332534689309,11275020293340759441,524288 --field-trial-handle=2672,i,4228428223198884130,6699847346266685393,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
        5⤵
        
        PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/eula/
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/eula/
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/eula/
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/eula/
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/eula/
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/eula/
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/eula/
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/eula/
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/eula/
    3⤵
    PID:6456
- - C:\Windows\system32\certutil.exe
    "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-UPK6I.tmp\BaltimoreCyberTrustRoot.crt"
    3⤵
    - Installs a root certificate to the trusted certificate store
    PID:4516
- - C:\Windows\system32\certutil.exe
    "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-UPK6I.tmp\DigiCertEVRoot.crt"
    3⤵
    - Installs a root certificate to the trusted certificate store
    PID:6308
- - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /service
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:6796
- - C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6816

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5304
- C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6976
- C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 1 /status off true /updatesubstatus none /scansubstatus recommended /settingssubstatus none
  2⤵
  - Executes dropped EXE
  PID:4892

C:\Windows\system32\drivers\mbae64.sys
C:\Windows\system32\drivers\mbae64.sys
1⤵
- Executes dropped EXE
PID:1840

C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4592

C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6196

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a3b855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:7120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:6972

C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -wdenable
1⤵
- Drops file in Windows directory
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery