ratonrat | 94099cdb75602d3170ac274255e8ad7392693ed7423f6bbf75c705bf7cfd832d

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	notepad.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3920	powershell.exe
3920	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	notepad.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	notepad.exe

Executes dropped EXE 2 IoCs

pid	Process
5036	notepad.exe
4856	notepad.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
38	discord.com
43	discord.com
48	discord.com
31	discord.com
32	discord.com
34	discord.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

ioc	Process
\??\F:\	powershell.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	notepad.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	notepad.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_360915241\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_1329584178\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_1329584178\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_520555302\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_1126507055\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_1126507055\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_520555302\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_1126507055\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_1126507055\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5344	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	notepad.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	notepad.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4968	msedge.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3524	timeout.exe
5016	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{D91B7912-20DE-443F-BF73-CAA9519647CC}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{EAC6A611-3FC4-4037-BE57-13C8901DA7E3}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
6812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
5036	notepad.exe
5036	notepad.exe
3920	powershell.exe
3920	powershell.exe
3920	powershell.exe
3920	powershell.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe
5036	notepad.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	notepad.exe
Token: SeDebugPrivilege	3920	powershell.exe
Token: SeIncreaseQuotaPrivilege	3920	powershell.exe
Token: SeSecurityPrivilege	3920	powershell.exe
Token: SeTakeOwnershipPrivilege	3920	powershell.exe
Token: SeLoadDriverPrivilege	3920	powershell.exe
Token: SeSystemProfilePrivilege	3920	powershell.exe
Token: SeSystemtimePrivilege	3920	powershell.exe
Token: SeProfSingleProcessPrivilege	3920	powershell.exe
Token: SeIncBasePriorityPrivilege	3920	powershell.exe
Token: SeCreatePagefilePrivilege	3920	powershell.exe
Token: SeBackupPrivilege	3920	powershell.exe
Token: SeRestorePrivilege	3920	powershell.exe
Token: SeShutdownPrivilege	3920	powershell.exe
Token: SeDebugPrivilege	3920	powershell.exe
Token: SeSystemEnvironmentPrivilege	3920	powershell.exe
Token: SeRemoteShutdownPrivilege	3920	powershell.exe
Token: SeUndockPrivilege	3920	powershell.exe
Token: SeManageVolumePrivilege	3920	powershell.exe
Token: 33	3920	powershell.exe
Token: 34	3920	powershell.exe
Token: 35	3920	powershell.exe
Token: 36	3920	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1052	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 6008 wrote to memory of 5344	6008	notepad.exe	89
PID 5344 wrote to memory of 2224	5344	cmd.exe	91
PID 5344 wrote to memory of 3524	5344	cmd.exe	92
PID 5344 wrote to memory of 5036	5344	cmd.exe	93
PID 5344 wrote to memory of 5016	5344	cmd.exe	94
PID 5036 wrote to memory of 1052	5036	notepad.exe	96
PID 5036 wrote to memory of 3920	5036	notepad.exe	97
PID 1052 wrote to memory of 4684	1052	msedge.exe	99
PID 1052 wrote to memory of 3732	1052	msedge.exe	102
PID 1052 wrote to memory of 4968	1052	msedge.exe	101
PID 1052 wrote to memory of 3732	1052	msedge.exe	102
PID 1052 wrote to memory of 3732	1052	msedge.exe	102
PID 1052 wrote to memory of 2404	1052	msedge.exe	103
PID 1052 wrote to memory of 2404	1052	msedge.exe	103
PID 1052 wrote to memory of 572	1052	msedge.exe	105
PID 1052 wrote to memory of 616	1052	msedge.exe	104
PID 1052 wrote to memory of 572	1052	msedge.exe	105
PID 1052 wrote to memory of 572	1052	msedge.exe	105
PID 1052 wrote to memory of 616	1052	msedge.exe	104
PID 1052 wrote to memory of 616	1052	msedge.exe	104
PID 1052 wrote to memory of 2012	1052	msedge.exe	106
PID 1052 wrote to memory of 2012	1052	msedge.exe	106
PID 1052 wrote to memory of 2012	1052	msedge.exe	106
PID 1052 wrote to memory of 3500	1052	msedge.exe	107
PID 1052 wrote to memory of 3500	1052	msedge.exe	107
PID 1052 wrote to memory of 3500	1052	msedge.exe	107
PID 1052 wrote to memory of 5732	1052	msedge.exe	108
PID 1052 wrote to memory of 5732	1052	msedge.exe	108
PID 1052 wrote to memory of 5364	1052	msedge.exe	110
PID 1052 wrote to memory of 5364	1052	msedge.exe	110
PID 1052 wrote to memory of 5364	1052	msedge.exe	110
PID 1052 wrote to memory of 2776	1052	msedge.exe	112
PID 1052 wrote to memory of 2776	1052	msedge.exe	112
PID 1052 wrote to memory of 5020	1052	msedge.exe	113
PID 1052 wrote to memory of 5020	1052	msedge.exe	113
PID 1052 wrote to memory of 1808	1052	msedge.exe	114
PID 1052 wrote to memory of 3280	1052	msedge.exe	115
PID 1052 wrote to memory of 3280	1052	msedge.exe	115
PID 1052 wrote to memory of 2588	1052	msedge.exe	117
PID 1052 wrote to memory of 3192	1052	msedge.exe	118
PID 1052 wrote to memory of 3192	1052	msedge.exe	118
PID 5036 wrote to memory of 6812	5036	notepad.exe	121
PID 1052 wrote to memory of 7036	1052	msedge.exe	123
PID 1052 wrote to memory of 7036	1052	msedge.exe	123
PID 1052 wrote to memory of 1196	1052	msedge.exe	127
PID 1052 wrote to memory of 5336	1052	msedge.exe	128
PID 1052 wrote to memory of 3764	1052	msedge.exe	129
PID 1052 wrote to memory of 5672	1052	msedge.exe	130
PID 1052 wrote to memory of 5672	1052	msedge.exe	130
PID 1052 wrote to memory of 6180	1052	msedge.exe	134
PID 1052 wrote to memory of 6180	1052	msedge.exe	134
PID 1052 wrote to memory of 6512	1052	msedge.exe	135
PID 1052 wrote to memory of 6512	1052	msedge.exe	135
PID 1052 wrote to memory of 1332	1052	msedge.exe	136
PID 1052 wrote to memory of 1332	1052	msedge.exe	136
PID 1052 wrote to memory of 2952	1052	msedge.exe	137
PID 1052 wrote to memory of 7036	1052	msedge.exe	138
PID 1052 wrote to memory of 7036	1052	msedge.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\notepad.exe
"C:\Users\Admin\AppData\Local\Temp\notepad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_e3b1AZ5MjM1JauCPeKVmQfqm5kCIgr.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5344
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2224
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3524
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\notepad.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\notepad.exe"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/kmj6qKqbcc
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ff84eb0c188,0x7ff84eb0c194,0x7ff84eb0c1a0
        5⤵
        
        PID:4684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,5559262192566471615,6061634666796725520,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,15083422699676874279,14507244187497336518,262144 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
        5⤵
        
        PID:3732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,9210268263129858750,10113026568126808757,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
        5⤵
        
        PID:2404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,11552629068498246500,14796577440868786860,2097152 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
        5⤵
        
        PID:616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,10512402884819607869,10771217844127632933,2097152 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
        5⤵
        
        PID:572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,2691507751441901766,11404686688033999903,2097152 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
        5⤵
        
        PID:2012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,17240847146795166639,13048155811169806184,2097152 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
        5⤵
        
        PID:3500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,10237345233851897704,5571739276621651356,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
        5⤵
        
        PID:5732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5424,i,10831015933520102161,8010686679790304215,2097152 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
        5⤵
        
        PID:5364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,16205618639451283562,15054131061125659320,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
        5⤵
        
        PID:2776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,12339635941145701284,5996720506587033906,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
        5⤵
        
        PID:5020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,18019390555140089020,14328875523500010035,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:1808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,18041929484318327719,8183960887383971625,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:12
        5⤵
        
        PID:3280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,5233917592983029657,5241100602760481023,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
        5⤵
        
        PID:2684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,5233917592983029657,5241100602760481023,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
        5⤵
        
        PID:2588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,15210799483917578544,10288430788180944310,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
        5⤵
        
        PID:3192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7556,i,5084526608764216425,11407481141414841661,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:14
        5⤵
        
        PID:7036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,13187416342661171852,2179106949829970169,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
        5⤵
        
        PID:1196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,12558126871465398773,1725807356546115670,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
        5⤵
        
        PID:5336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,4531825192838047760,1957345854213496846,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
        5⤵
        
        PID:3764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,4725434436171410311,10486744406093385134,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
        5⤵
        
        PID:5672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,5881784185186597023,13125669469259475778,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
        5⤵
        
        PID:6180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7396,i,8939164773237783353,11049933705585502975,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
        5⤵
        
        PID:6512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,9977734966136356778,7810033354704621722,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
        5⤵
        
        PID:1332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7856,i,9682848606017764840,3860537215642059153,262144 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,6894376446692639619,7217695436660757051,524288 --field-trial-handle=2284,i,17337879920838979809,6870644393146726778,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
        5⤵
        
        PID:7036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\notepad.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3920
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "notepad" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\notepad.exe\"" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6812
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4516

C:\Users\Admin\AppData\Roaming\PlatformRuntime\notepad.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\notepad.exe"
1⤵
- Executes dropped EXE
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Virtualization/Sandbox Evasion