asyncrat | hxxps://github[.]com/phxn-blip?tab=repositories

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	BootStrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	AsyncClient.exe

Executes dropped EXE 8 IoCs

pid	Process
4136	BootStrapper.exe
5224	AsyncClient.exe
5800	SystemApplication.exe
5920	SystemApplication.exe
5172	Client-built.exe
2872	Client.exe
5348	Client.exe
5648	BootStrapper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5424	cmd.exe
5448	cmd.exe
5572	cmd.exe
5736	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemApplication.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemApplication.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootStrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootStrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4540	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5520	timeout.exe
5784	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304258366340633"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{F016130F-DB63-4608-8456-58AB44DDEF81}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5660	schtasks.exe
5200	schtasks.exe
5140	schtasks.exe
5544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
4136	BootStrapper.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5224	AsyncClient.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe
5648	BootStrapper.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2908	7zFM.exe
5948	7zFM.exe
5432	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeRestorePrivilege	2908	7zFM.exe
Token: 35	2908	7zFM.exe
Token: SeSecurityPrivilege	2908	7zFM.exe
Token: SeSecurityPrivilege	2908	7zFM.exe
Token: SeDebugPrivilege	4136	BootStrapper.exe
Token: SeDebugPrivilege	5224	AsyncClient.exe
Token: SeRestorePrivilege	5948	7zFM.exe
Token: 35	5948	7zFM.exe
Token: SeDebugPrivilege	5800	SystemApplication.exe
Token: SeDebugPrivilege	5800	SystemApplication.exe
Token: SeSecurityPrivilege	5948	7zFM.exe
Token: SeDebugPrivilege	5172	Client-built.exe
Token: SeDebugPrivilege	2872	Client.exe
Token: SeDebugPrivilege	5348	Client.exe
Token: SeRestorePrivilege	5432	7zFM.exe
Token: 35	5432	7zFM.exe
Token: SeSecurityPrivilege	5432	7zFM.exe
Token: SeDebugPrivilege	5648	BootStrapper.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
2908	7zFM.exe
2908	7zFM.exe
2908	7zFM.exe
5948	7zFM.exe
5948	7zFM.exe
2872	Client.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
2872	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 3520	1396	msedge.exe	86
PID 1396 wrote to memory of 1460	1396	msedge.exe	87
PID 1396 wrote to memory of 4540	1396	msedge.exe	88
PID 1396 wrote to memory of 1460	1396	msedge.exe	87
PID 1396 wrote to memory of 1460	1396	msedge.exe	87
PID 1396 wrote to memory of 1988	1396	msedge.exe	89
PID 1396 wrote to memory of 1988	1396	msedge.exe	89
PID 1396 wrote to memory of 4068	1396	msedge.exe	101
PID 1396 wrote to memory of 3820	1396	msedge.exe	91
PID 1396 wrote to memory of 4068	1396	msedge.exe	101
PID 1396 wrote to memory of 4068	1396	msedge.exe	101
PID 1396 wrote to memory of 3820	1396	msedge.exe	91
PID 1396 wrote to memory of 3820	1396	msedge.exe	91
PID 1396 wrote to memory of 1536	1396	msedge.exe	93
PID 1396 wrote to memory of 1536	1396	msedge.exe	93
PID 1396 wrote to memory of 1536	1396	msedge.exe	93
PID 1396 wrote to memory of 3540	1396	msedge.exe	94
PID 1396 wrote to memory of 3540	1396	msedge.exe	94
PID 1396 wrote to memory of 3540	1396	msedge.exe	94
PID 1396 wrote to memory of 2892	1396	msedge.exe	98
PID 1396 wrote to memory of 2656	1396	msedge.exe	99
PID 1396 wrote to memory of 2892	1396	msedge.exe	98
PID 1396 wrote to memory of 2656	1396	msedge.exe	99
PID 1396 wrote to memory of 4068	1396	msedge.exe	101
PID 1396 wrote to memory of 4620	1396	msedge.exe	104
PID 1396 wrote to memory of 4620	1396	msedge.exe	104
PID 1396 wrote to memory of 4236	1396	msedge.exe	105
PID 1396 wrote to memory of 4236	1396	msedge.exe	105
PID 1396 wrote to memory of 4236	1396	msedge.exe	105
PID 1396 wrote to memory of 1128	1396	msedge.exe	117
PID 1396 wrote to memory of 2584	1396	msedge.exe	118
PID 1396 wrote to memory of 3216	1396	msedge.exe	119
PID 1396 wrote to memory of 2156	1396	msedge.exe	120
PID 1396 wrote to memory of 2156	1396	msedge.exe	120
PID 1396 wrote to memory of 2156	1396	msedge.exe	120
PID 1396 wrote to memory of 2908	1396	msedge.exe	121
PID 1396 wrote to memory of 2908	1396	msedge.exe	121
PID 1396 wrote to memory of 2908	1396	msedge.exe	121
PID 1396 wrote to memory of 2752	1396	msedge.exe	122
PID 1396 wrote to memory of 2752	1396	msedge.exe	122
PID 1396 wrote to memory of 2752	1396	msedge.exe	122
PID 1396 wrote to memory of 1600	1396	msedge.exe	123
PID 1396 wrote to memory of 1704	1396	msedge.exe	125
PID 1396 wrote to memory of 1704	1396	msedge.exe	125
PID 1396 wrote to memory of 1704	1396	msedge.exe	125
PID 1396 wrote to memory of 4164	1396	msedge.exe	126
PID 1396 wrote to memory of 2364	1396	msedge.exe	127
PID 1396 wrote to memory of 2364	1396	msedge.exe	127
PID 1396 wrote to memory of 2364	1396	msedge.exe	127
PID 1396 wrote to memory of 1772	1396	msedge.exe	128
PID 1396 wrote to memory of 2752	1396	msedge.exe	132
PID 1396 wrote to memory of 2752	1396	msedge.exe	132
PID 2908 wrote to memory of 4136	2908	7zFM.exe	134
PID 2908 wrote to memory of 5224	2908	7zFM.exe	136
PID 1396 wrote to memory of 5268	1396	msedge.exe	137
PID 1396 wrote to memory of 5268	1396	msedge.exe	137
PID 4136 wrote to memory of 5424	4136	BootStrapper.exe	138
PID 4136 wrote to memory of 5448	4136	BootStrapper.exe	140
PID 5448 wrote to memory of 5520	5448	cmd.exe	142
PID 5424 wrote to memory of 5544	5424	cmd.exe	143
PID 5224 wrote to memory of 5572	5224	AsyncClient.exe	144
PID 5572 wrote to memory of 5660	5572	cmd.exe	147
PID 5224 wrote to memory of 5736	5224	AsyncClient.exe	148
PID 5736 wrote to memory of 5784	5736	cmd.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/phxn-blip?tab=repositories
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x294,0x7fff6b8ec188,0x7fff6b8ec194,0x7fff6b8ec1a0
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,17378430079133297730,9330381397632513067,262144 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,17582124395893751995,14098420577930550413,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,11484680801756102876,15143876050774384125,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,4456140745610529561,6358007833764989394,2097152 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,13055739204348995293,11231379165903661013,2097152 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,16170133109810860411,9462123029466477980,2097152 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,13143380595398909953,9309585164065034322,2097152 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,17714503366305306362,5932727345029283077,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,384994479257405153,3112714707957140674,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,706098614494522668,17349198087284329457,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,706098614494522668,17349198087284329457,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,1314739342160268244,11933629800255917313,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6380,i,2099071498162426417,13536862563077710567,2097152 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,2328552426585039995,9761621454576136024,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,6791126132472854483,6132901419182619667,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,6157751972798104364,2322308820987076018,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3424,i,9524063863660491024,16181882384108422192,2097152 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6632,i,12757829007124629230,6192918456525183377,2097152 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6772,i,2385513116580168544,6951768735528506415,2097152 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,1798760175764662320,4848168407448972250,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4336,i,14975292120859118364,4364304236027562878,2097152 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,8467477572297712539,14261439471327570677,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6868,i,17568530118198067673,1817577340733661018,2097152 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,9931829528421079638,755337935272856638,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,1848387011109497222,1488743909601684454,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,12479730583616816220,17001896974384133482,524288 --field-trial-handle=2240,i,5516160381932081193,9766058613769454892,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:5268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2448

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\VelocityBootstrapper-main.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\7zOC5B17679\BootStrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOC5B17679\BootStrapper.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "SystemApplication" /tr '"C:\Users\Admin\AppData\Roaming\SystemApplication.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5424
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "SystemApplication" /tr '"C:\Users\Admin\AppData\Roaming\SystemApplication.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6CE9.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5448
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5520
  - - C:\Users\Admin\AppData\Roaming\SystemApplication.exe
      "C:\Users\Admin\AppData\Roaming\SystemApplication.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5800
- C:\Users\Admin\AppData\Local\Temp\7zOC5B0FC79\AsyncClient.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOC5B0FC79\AsyncClient.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "SystemApplication" /tr '"C:\Users\Admin\AppData\Roaming\SystemApplication.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "SystemApplication" /tr '"C:\Users\Admin\AppData\Roaming\SystemApplication.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp71CB.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5784
  - - C:\Users\Admin\AppData\Roaming\SystemApplication.exe
      "C:\Users\Admin\AppData\Roaming\SystemApplication.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5920

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\quasar-main.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5948
- C:\Users\Admin\AppData\Local\Temp\7zOC37D96D9\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOC37D96D9\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5172
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5200
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2872
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5140

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5348

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\VelocityBootstrapperr-main.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5432
- C:\Users\Admin\AppData\Local\Temp\7zO83571EE9\BootStrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO83571EE9\BootStrapper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery