08d73dc78c7bf954f17d0708412e23a355fe76e1ff97220da47e87b2a13b978a

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF06AD2E1DCA4F54E8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1419521611\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1285984553\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFC6B30F5894FED4F2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB5E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB6E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF39DD9E5F39F06C33.TMP	msiexec.exe
File created	C:\Windows\Installer\e59f43a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f43a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{21F0EA31-E1CD-4463-9E0C-F9E5B13E3B74}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12E0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF36130BB5B044F668.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC09.tmp	msiexec.exe
File created	C:\Windows\Installer\e59f43c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1285984553\protocols.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5744	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSIFB6E.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSIFB6E.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSI12E0.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSI12E0.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PDFMaestro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PDFMaestro.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1912	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{0A6366A2-548A-4C6D-BF19-02DF58156619}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2120	schtasks.exe
4708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp
5520	MSI9735.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5744	msiexec.exe
Token: SeSecurityPrivilege	4328	msiexec.exe
Token: SeCreateTokenPrivilege	5744	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5744	msiexec.exe
Token: SeLockMemoryPrivilege	5744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5744	msiexec.exe
Token: SeMachineAccountPrivilege	5744	msiexec.exe
Token: SeTcbPrivilege	5744	msiexec.exe
Token: SeSecurityPrivilege	5744	msiexec.exe
Token: SeTakeOwnershipPrivilege	5744	msiexec.exe
Token: SeLoadDriverPrivilege	5744	msiexec.exe
Token: SeSystemProfilePrivilege	5744	msiexec.exe
Token: SeSystemtimePrivilege	5744	msiexec.exe
Token: SeProfSingleProcessPrivilege	5744	msiexec.exe
Token: SeIncBasePriorityPrivilege	5744	msiexec.exe
Token: SeCreatePagefilePrivilege	5744	msiexec.exe
Token: SeCreatePermanentPrivilege	5744	msiexec.exe
Token: SeBackupPrivilege	5744	msiexec.exe
Token: SeRestorePrivilege	5744	msiexec.exe
Token: SeShutdownPrivilege	5744	msiexec.exe
Token: SeDebugPrivilege	5744	msiexec.exe
Token: SeAuditPrivilege	5744	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5744	msiexec.exe
Token: SeChangeNotifyPrivilege	5744	msiexec.exe
Token: SeRemoteShutdownPrivilege	5744	msiexec.exe
Token: SeUndockPrivilege	5744	msiexec.exe
Token: SeSyncAgentPrivilege	5744	msiexec.exe
Token: SeEnableDelegationPrivilege	5744	msiexec.exe
Token: SeManageVolumePrivilege	5744	msiexec.exe
Token: SeImpersonatePrivilege	5744	msiexec.exe
Token: SeCreateGlobalPrivilege	5744	msiexec.exe
Token: SeCreateTokenPrivilege	5744	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5744	msiexec.exe
Token: SeLockMemoryPrivilege	5744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5744	msiexec.exe
Token: SeMachineAccountPrivilege	5744	msiexec.exe
Token: SeTcbPrivilege	5744	msiexec.exe
Token: SeSecurityPrivilege	5744	msiexec.exe
Token: SeTakeOwnershipPrivilege	5744	msiexec.exe
Token: SeLoadDriverPrivilege	5744	msiexec.exe
Token: SeSystemProfilePrivilege	5744	msiexec.exe
Token: SeSystemtimePrivilege	5744	msiexec.exe
Token: SeProfSingleProcessPrivilege	5744	msiexec.exe
Token: SeIncBasePriorityPrivilege	5744	msiexec.exe
Token: SeCreatePagefilePrivilege	5744	msiexec.exe
Token: SeCreatePermanentPrivilege	5744	msiexec.exe
Token: SeBackupPrivilege	5744	msiexec.exe
Token: SeRestorePrivilege	5744	msiexec.exe
Token: SeShutdownPrivilege	5744	msiexec.exe
Token: SeDebugPrivilege	5744	msiexec.exe
Token: SeAuditPrivilege	5744	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5744	msiexec.exe
Token: SeChangeNotifyPrivilege	5744	msiexec.exe
Token: SeRemoteShutdownPrivilege	5744	msiexec.exe
Token: SeUndockPrivilege	5744	msiexec.exe
Token: SeSyncAgentPrivilege	5744	msiexec.exe
Token: SeEnableDelegationPrivilege	5744	msiexec.exe
Token: SeManageVolumePrivilege	5744	msiexec.exe
Token: SeImpersonatePrivilege	5744	msiexec.exe
Token: SeCreateGlobalPrivilege	5744	msiexec.exe
Token: SeCreateTokenPrivilege	5744	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5744	msiexec.exe
Token: SeLockMemoryPrivilege	5744	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5744	msiexec.exe
1848	msedge.exe
5744	msiexec.exe
5420	PDFMaestro.exe
5420	PDFMaestro.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5420	PDFMaestro.exe
5420	PDFMaestro.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5744	msiexec.exe
4328	msiexec.exe
2780	MsiExec.exe
5492	MsiExec.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 2780	4328	msiexec.exe	89
PID 5744 wrote to memory of 5520	5744	msiexec.exe	90
PID 4328 wrote to memory of 3204	4328	msiexec.exe	95
PID 4328 wrote to memory of 5492	4328	msiexec.exe	97
PID 4328 wrote to memory of 2884	4328	msiexec.exe	98
PID 4328 wrote to memory of 3304	4328	msiexec.exe	99
PID 4328 wrote to memory of 3344	4328	msiexec.exe	102
PID 3344 wrote to memory of 1848	3344	MSI12E0.tmp	104
PID 1848 wrote to memory of 4372	1848	msedge.exe	105
PID 1848 wrote to memory of 1912	1848	msedge.exe	107
PID 1848 wrote to memory of 2932	1848	msedge.exe	108
PID 1848 wrote to memory of 2932	1848	msedge.exe	108
PID 1848 wrote to memory of 2932	1848	msedge.exe	108
PID 1848 wrote to memory of 2324	1848	msedge.exe	109
PID 1848 wrote to memory of 2324	1848	msedge.exe	109
PID 1848 wrote to memory of 5964	1848	msedge.exe	110
PID 1848 wrote to memory of 1156	1848	msedge.exe	111
PID 1848 wrote to memory of 5964	1848	msedge.exe	110
PID 1848 wrote to memory of 5964	1848	msedge.exe	110
PID 1848 wrote to memory of 1156	1848	msedge.exe	111
PID 1848 wrote to memory of 1156	1848	msedge.exe	111
PID 3344 wrote to memory of 2120	3344	MSI12E0.tmp	112
PID 1848 wrote to memory of 5240	1848	msedge.exe	115
PID 1848 wrote to memory of 5240	1848	msedge.exe	115
PID 1848 wrote to memory of 5240	1848	msedge.exe	115
PID 1848 wrote to memory of 5928	1848	msedge.exe	114
PID 1848 wrote to memory of 5928	1848	msedge.exe	114
PID 1848 wrote to memory of 5928	1848	msedge.exe	114
PID 1848 wrote to memory of 1052	1848	msedge.exe	116
PID 1848 wrote to memory of 1052	1848	msedge.exe	116
PID 1848 wrote to memory of 1152	1848	msedge.exe	118
PID 1848 wrote to memory of 1152	1848	msedge.exe	118
PID 1848 wrote to memory of 1152	1848	msedge.exe	118
PID 3344 wrote to memory of 1368	3344	MSI12E0.tmp	119
PID 1848 wrote to memory of 4956	1848	msedge.exe	121
PID 1848 wrote to memory of 1356	1848	msedge.exe	122
PID 1848 wrote to memory of 4956	1848	msedge.exe	121
PID 1848 wrote to memory of 1356	1848	msedge.exe	122
PID 1848 wrote to memory of 4296	1848	msedge.exe	124
PID 5420 wrote to memory of 4708	5420	PDFMaestro.exe	127
PID 1848 wrote to memory of 5684	1848	msedge.exe	129
PID 1848 wrote to memory of 5684	1848	msedge.exe	129
PID 1848 wrote to memory of 3892	1848	msedge.exe	130
PID 1848 wrote to memory of 3892	1848	msedge.exe	130
PID 1848 wrote to memory of 4092	1848	msedge.exe	133
PID 1848 wrote to memory of 6124	1848	msedge.exe	134
PID 1848 wrote to memory of 3908	1848	msedge.exe	135
PID 1848 wrote to memory of 4800	1848	msedge.exe	136
PID 1848 wrote to memory of 4800	1848	msedge.exe	136
PID 1848 wrote to memory of 6004	1848	msedge.exe	140
PID 1848 wrote to memory of 6004	1848	msedge.exe	140
PID 1848 wrote to memory of 3348	1848	msedge.exe	141
PID 1848 wrote to memory of 3348	1848	msedge.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PDFMaestroSetup.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Users\Admin\AppData\Local\Temp\MSI9735.tmp
  "C:\Users\Admin\AppData\Local\Temp\MSI9735.tmp" DisableCancelButton
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5520

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AB727AD02B4D1CC67429A70BFE58A2D8 C
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2780
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3204
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 35ACB41DF6007544D6B39CD06187F2A4
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5492
- C:\Windows\Installer\MSIFB5E.tmp
  "C:\Windows\Installer\MSIFB5E.tmp" DisableCancelButton
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\Installer\MSIFB6E.tmp
  "C:\Windows\Installer\MSIFB6E.tmp" Install_Start
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3304
- C:\Windows\Installer\MSI12E0.tmp
  "C:\Windows\Installer\MSI12E0.tmp" Install_Success
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pdfmaestro.ai/thank-you.html?country=GB
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x364,0x7fff27b4c188,0x7fff27b4c194,0x7fff27b4c1a0
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,10462152029505318650,10667776071483818176,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
      4⤵
      System Time Discovery
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,1294207683952422913,3306258126379238909,262144 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,17784902020835748567,16593465101048251537,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:13
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,6817820093006472047,4501842799302046029,2097152 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,8376186490479705264,6227686493584934179,2097152 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,4779929819471906573,4016114111520598412,2097152 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4088,i,2393737158695002630,7987620863531715962,2097152 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:9
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,4435549169022514773,11756745497562163502,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5404,i,15072722770319006925,6658035920795762681,2097152 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,15655884228680242247,10267541151302484502,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,37494592658985540,15674084462716607200,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,15912282692455813117,15120654265406156341,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,15912282692455813117,15120654265406156341,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,13235807193097495552,14628751462086374027,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,9041222785675021967,7113351399757024331,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,15344484428703168272,3156284763686267331,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,17041592433842480337,7511565421129701847,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,17611138496857151506,14520696320248988497,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,2903645172735031082,18305072194418459593,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,6468692017933150735,7436834664271438187,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,8960331350367725357,473868154746693616,524288 --field-trial-handle=2248,i,5481221807535615431,17433619158980059696,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:14
      4⤵
      PID:3348
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn "PDFMaestroUpdater" /xml "C:\Users\Admin\AppData\Local\Temp\task_c10e9ed0875e42c89c85789cba23f8fe.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2120
- - C:\Users\Admin\AppData\Roaming\SB\PM\PDFMaestro.exe
    "C:\Users\Admin\AppData\Roaming\SB\PM\PDFMaestro.exe" /initialize
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2664

C:\Users\Admin\AppData\Roaming\SB\PM\PDFMaestro.exe
C:\Users\Admin\AppData\Roaming\SB\PM\PDFMaestro.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "PDFMaestroUpdater" /xml "C:\Users\Admin\AppData\Local\Temp\task_059b85efbabe4f08a968ce12f4dcc558.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery