hxxps://wind2365[.]juridico[.]bond/f/oMLtBK79MDCrgKi037xb7AuSXe4FoWL8ODBIYUc85Bc#u=uid%3Dlink-332-3002122c824f7c3190f3-f3bdb70bc9a6%26nonce%3D83aOC6bX8VeoncBD-D5pOjlJVfZgWwqoG4aHlC51oDn4S2vwvGnU459oWmZonMNA%26ts%3D1784668243993410300%26rid%3Df3bdb70bc9a6413a8ea539213a7a8bbc%26sig%3D3002122c824f7c3190f3ee639232b75993fc8c1034e2a7e1b9a8dfb8b17298ce

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemGuardRuntime = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Temp\\SearchProtocol.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemGuardRuntime = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Temp\\SearchProtocol.vbs\""	WScript.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
119	api.ipify.org
120	api.ipify.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
2936	WScript.exe
1368	wscript.exe
3308	WScript.exe
4676	wscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2552	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4716	taskkill.exe
4876	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303539711280498"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{7E9E4F45-9743-4C4C-A993-578D4102BE91}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1244	schtasks.exe
4680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
932	powershell.exe
932	powershell.exe
932	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
4164	msedge.exe
4164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeIncreaseQuotaPrivilege	1948	powershell.exe
Token: SeSecurityPrivilege	1948	powershell.exe
Token: SeTakeOwnershipPrivilege	1948	powershell.exe
Token: SeLoadDriverPrivilege	1948	powershell.exe
Token: SeSystemProfilePrivilege	1948	powershell.exe
Token: SeSystemtimePrivilege	1948	powershell.exe
Token: SeProfSingleProcessPrivilege	1948	powershell.exe
Token: SeIncBasePriorityPrivilege	1948	powershell.exe
Token: SeCreatePagefilePrivilege	1948	powershell.exe
Token: SeBackupPrivilege	1948	powershell.exe
Token: SeRestorePrivilege	1948	powershell.exe
Token: SeShutdownPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeSystemEnvironmentPrivilege	1948	powershell.exe
Token: SeRemoteShutdownPrivilege	1948	powershell.exe
Token: SeUndockPrivilege	1948	powershell.exe
Token: SeManageVolumePrivilege	1948	powershell.exe
Token: 33	1948	powershell.exe
Token: 34	1948	powershell.exe
Token: 35	1948	powershell.exe
Token: 36	1948	powershell.exe
Token: SeDebugPrivilege	4716	taskkill.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeIncreaseQuotaPrivilege	1948	powershell.exe
Token: SeSecurityPrivilege	1948	powershell.exe
Token: SeTakeOwnershipPrivilege	1948	powershell.exe
Token: SeLoadDriverPrivilege	1948	powershell.exe
Token: SeSystemProfilePrivilege	1948	powershell.exe
Token: SeSystemtimePrivilege	1948	powershell.exe
Token: SeProfSingleProcessPrivilege	1948	powershell.exe
Token: SeIncBasePriorityPrivilege	1948	powershell.exe
Token: SeCreatePagefilePrivilege	1948	powershell.exe
Token: SeBackupPrivilege	1948	powershell.exe
Token: SeRestorePrivilege	1948	powershell.exe
Token: SeShutdownPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeSystemEnvironmentPrivilege	1948	powershell.exe
Token: SeRemoteShutdownPrivilege	1948	powershell.exe
Token: SeUndockPrivilege	1948	powershell.exe
Token: SeManageVolumePrivilege	1948	powershell.exe
Token: 33	1948	powershell.exe
Token: 34	1948	powershell.exe
Token: 35	1948	powershell.exe
Token: 36	1948	powershell.exe
Token: SeIncreaseQuotaPrivilege	1948	powershell.exe
Token: SeSecurityPrivilege	1948	powershell.exe
Token: SeTakeOwnershipPrivilege	1948	powershell.exe
Token: SeLoadDriverPrivilege	1948	powershell.exe
Token: SeSystemProfilePrivilege	1948	powershell.exe
Token: SeSystemtimePrivilege	1948	powershell.exe
Token: SeProfSingleProcessPrivilege	1948	powershell.exe
Token: SeIncBasePriorityPrivilege	1948	powershell.exe
Token: SeCreatePagefilePrivilege	1948	powershell.exe
Token: SeBackupPrivilege	1948	powershell.exe
Token: SeRestorePrivilege	1948	powershell.exe
Token: SeShutdownPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeSystemEnvironmentPrivilege	1948	powershell.exe
Token: SeRemoteShutdownPrivilege	1948	powershell.exe
Token: SeUndockPrivilege	1948	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3396	2356	msedge.exe	87
PID 2356 wrote to memory of 2552	2356	msedge.exe	88
PID 2356 wrote to memory of 2780	2356	msedge.exe	89
PID 2356 wrote to memory of 2780	2356	msedge.exe	89
PID 2356 wrote to memory of 2780	2356	msedge.exe	89
PID 2356 wrote to memory of 2776	2356	msedge.exe	91
PID 2356 wrote to memory of 2776	2356	msedge.exe	91
PID 2356 wrote to memory of 2076	2356	msedge.exe	92
PID 2356 wrote to memory of 2076	2356	msedge.exe	92
PID 2356 wrote to memory of 2076	2356	msedge.exe	92
PID 2356 wrote to memory of 1348	2356	msedge.exe	93
PID 2356 wrote to memory of 1348	2356	msedge.exe	93
PID 2356 wrote to memory of 1348	2356	msedge.exe	93
PID 2356 wrote to memory of 4208	2356	msedge.exe	94
PID 2356 wrote to memory of 4996	2356	msedge.exe	95
PID 2356 wrote to memory of 4208	2356	msedge.exe	94
PID 2356 wrote to memory of 4208	2356	msedge.exe	94
PID 2356 wrote to memory of 4996	2356	msedge.exe	95
PID 2356 wrote to memory of 4996	2356	msedge.exe	95
PID 2356 wrote to memory of 3304	2356	msedge.exe	98
PID 2356 wrote to memory of 3304	2356	msedge.exe	98
PID 2356 wrote to memory of 1560	2356	msedge.exe	99
PID 2356 wrote to memory of 1560	2356	msedge.exe	99
PID 2356 wrote to memory of 3696	2356	msedge.exe	101
PID 2356 wrote to memory of 3164	2356	msedge.exe	102
PID 2356 wrote to memory of 4444	2356	msedge.exe	103
PID 2356 wrote to memory of 3164	2356	msedge.exe	102
PID 2356 wrote to memory of 4444	2356	msedge.exe	103
PID 2356 wrote to memory of 4444	2356	msedge.exe	103
PID 2356 wrote to memory of 4296	2356	msedge.exe	104
PID 2356 wrote to memory of 4544	2356	msedge.exe	114
PID 2356 wrote to memory of 5012	2356	msedge.exe	115
PID 2356 wrote to memory of 3580	2356	msedge.exe	116
PID 2356 wrote to memory of 1592	2356	msedge.exe	119
PID 2356 wrote to memory of 1592	2356	msedge.exe	119
PID 2936 wrote to memory of 4876	2936	WScript.exe	121
PID 2936 wrote to memory of 1368	2936	WScript.exe	123
PID 1368 wrote to memory of 932	1368	wscript.exe	124
PID 932 wrote to memory of 684	932	powershell.exe	126
PID 684 wrote to memory of 4912	684	csc.exe	127
PID 932 wrote to memory of 1948	932	powershell.exe	128
PID 1948 wrote to memory of 3992	1948	powershell.exe	130
PID 3992 wrote to memory of 2168	3992	csc.exe	131
PID 3308 wrote to memory of 4716	3308	WScript.exe	133
PID 3308 wrote to memory of 4676	3308	WScript.exe	135
PID 4676 wrote to memory of 1124	4676	wscript.exe	137
PID 2936 wrote to memory of 1244	2936	WScript.exe	139
PID 1124 wrote to memory of 4180	1124	powershell.exe	143
PID 4180 wrote to memory of 4552	4180	csc.exe	144
PID 1124 wrote to memory of 2492	1124	powershell.exe	145
PID 3308 wrote to memory of 4680	3308	WScript.exe	147
PID 2356 wrote to memory of 4164	2356	msedge.exe	149
PID 2356 wrote to memory of 3096	2356	msedge.exe	150
PID 2356 wrote to memory of 3096	2356	msedge.exe	150
PID 2356 wrote to memory of 5112	2356	msedge.exe	151
PID 2356 wrote to memory of 5112	2356	msedge.exe	151
PID 2356 wrote to memory of 2136	2356	msedge.exe	152
PID 2356 wrote to memory of 2136	2356	msedge.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wind2365.juridico.bond/f/oMLtBK79MDCrgKi037xb7AuSXe4FoWL8ODBIYUc85Bc#u=uid%3Dlink-332-3002122c824f7c3190f3-f3bdb70bc9a6%26nonce%3D83aOC6bX8VeoncBD-D5pOjlJVfZgWwqoG4aHlC51oDn4S2vwvGnU459oWmZonMNA%26ts%3D1784668243993410300%26rid%3Df3bdb70bc9a6413a8ea539213a7a8bbc%26sig%3D3002122c824f7c3190f3ee639232b75993fc8c1034e2a7e1b9a8dfb8b17298ce
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x248,0x7fffd884c188,0x7fffd884c194,0x7fffd884c1a0
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,13100101248669823683,152505535591974269,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,1457562879623720496,2619905530661034926,262144 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,828473688823164291,13907104520041091659,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,11996716990276639263,11463710716450920356,2097152 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,18084290263263527589,17498973114117397838,2097152 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,18360443681118685353,17454633903776110497,2097152 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,16397523223124412691,9969901070963645158,2097152 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,2236064863580130704,3681020625437428338,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,5638309586800573656,12674584510644809988,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,15287069178139346303,17384020449127455910,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,15287069178139346303,17384020449127455910,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,12400541456350197684,154155981814159902,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6272,i,5007147151914848987,1069052231238920679,2097152 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,12449309415597710796,5769969136023959920,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,7820778366825621034,10782403972987480486,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,17326771946536335400,16842561195069368139,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,11655109257228443685,13802862556955229785,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,3809679599699041506,14337126660287080050,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,10118662503408903033,16599788745131879921,262144 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,17887961046882923900,2685710466988091227,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,1606057846591679053,9073755243440040115,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,6281300722913504123,3684950140109523762,524288 --field-trial-handle=2180,i,1661764080072733402,724278231185794173,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3096

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\400A60_NOTIFICACION JUDICIAL_BEB428\NOTIFICACION JUDICIAL_BEB428_400A60.vbs"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4876
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\gj6p33828.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\wc80152.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bgvmaujt\bgvmaujt.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:684
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES42BC.tmp" "c:\Users\Admin\AppData\Local\Temp\bgvmaujt\CSC302F35005A744ECBDAB5F1DC345E0C6.TMP"
        5⤵
        
        PID:4912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\agent_1784154434.ps1"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1948
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ico4wrsi\ico4wrsi.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3992
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4944.tmp" "c:\Users\Admin\AppData\Local\Temp\ico4wrsi\CSC57B84A89C8564F8D873626C61CA4BDF2.TMP"
        6⤵
        
        PID:2168
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc onlogon /tn "WindowsUpdate" /tr "wscript.exe //B C:\Users\Admin\AppData\Roaming\System\Temp\SearchProtocol.vbs" /f /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1244

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\400A60_NOTIFICACION JUDICIAL_BEB428\NOTIFICACION JUDICIAL_BEB428_400A60.vbs"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\gj6p33828.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\wc80152.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2fbf4rom\2fbf4rom.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D18.tmp" "c:\Users\Admin\AppData\Local\Temp\2fbf4rom\CSCAB04593013DC4C208C6623CDFB9B254.TMP"
        5⤵
        
        PID:4552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\agent_1784154434.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2492
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc onlogon /tn "WindowsUpdate" /tr "wscript.exe //B C:\Users\Admin\AppData\Roaming\System\Temp\SearchProtocol.vbs" /f /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4680

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery