478cd0a076ef491d08a4eec8a8453e50a796fa03ac214942c57f8c5871989dd0

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MenaceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MenaceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MenaceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MenaceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	guaracha.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	guaracha.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_686220257\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_182913457\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_637693783\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_686220257\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_686220257\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_686220257\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_639040123\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_182913457\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_1303801411\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2208_639040123\crl-set	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	guaracha.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	guaracha.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MenaceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MenaceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MenaceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MenaceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MicrosoftEdgeUpdate.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4644	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{3BEDA873-18E2-4C2F-A206-A8A710DBB4EB}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
6092	schtasks.exe
3920	schtasks.exe
5908	schtasks.exe
5684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4008	guaracha.exe
4008	guaracha.exe
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe
4920	MenaceAgent.exe
4920	MenaceAgent.exe
540	MicrosoftEdgeUpdate.exe
540	MicrosoftEdgeUpdate.exe
5356	MenaceAgent.exe
5356	MenaceAgent.exe
4360	msedge.exe
4360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeIncreaseQuotaPrivilege	1120	powershell.exe
Token: SeSecurityPrivilege	1120	powershell.exe
Token: SeTakeOwnershipPrivilege	1120	powershell.exe
Token: SeLoadDriverPrivilege	1120	powershell.exe
Token: SeSystemProfilePrivilege	1120	powershell.exe
Token: SeSystemtimePrivilege	1120	powershell.exe
Token: SeProfSingleProcessPrivilege	1120	powershell.exe
Token: SeIncBasePriorityPrivilege	1120	powershell.exe
Token: SeCreatePagefilePrivilege	1120	powershell.exe
Token: SeBackupPrivilege	1120	powershell.exe
Token: SeRestorePrivilege	1120	powershell.exe
Token: SeShutdownPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeSystemEnvironmentPrivilege	1120	powershell.exe
Token: SeRemoteShutdownPrivilege	1120	powershell.exe
Token: SeUndockPrivilege	1120	powershell.exe
Token: SeManageVolumePrivilege	1120	powershell.exe
Token: 33	1120	powershell.exe
Token: 34	1120	powershell.exe
Token: 35	1120	powershell.exe
Token: 36	1120	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 4008	6120	guaracha.exe	84
PID 4008 wrote to memory of 2208	4008	guaracha.exe	86
PID 2208 wrote to memory of 4148	2208	msedge.exe	87
PID 2208 wrote to memory of 4644	2208	msedge.exe	88
PID 2208 wrote to memory of 3944	2208	msedge.exe	89
PID 2208 wrote to memory of 3944	2208	msedge.exe	89
PID 2208 wrote to memory of 3944	2208	msedge.exe	89
PID 2208 wrote to memory of 5680	2208	msedge.exe	90
PID 2208 wrote to memory of 5680	2208	msedge.exe	90
PID 2208 wrote to memory of 376	2208	msedge.exe	92
PID 2208 wrote to memory of 376	2208	msedge.exe	92
PID 2208 wrote to memory of 376	2208	msedge.exe	92
PID 2208 wrote to memory of 5180	2208	msedge.exe	93
PID 2208 wrote to memory of 5180	2208	msedge.exe	93
PID 2208 wrote to memory of 5180	2208	msedge.exe	93
PID 2208 wrote to memory of 5228	2208	msedge.exe	96
PID 2208 wrote to memory of 5228	2208	msedge.exe	96
PID 2208 wrote to memory of 5228	2208	msedge.exe	96
PID 2208 wrote to memory of 4372	2208	msedge.exe	101
PID 2208 wrote to memory of 3496	2208	msedge.exe	102
PID 2208 wrote to memory of 4372	2208	msedge.exe	101
PID 2208 wrote to memory of 3496	2208	msedge.exe	102
PID 2208 wrote to memory of 4940	2208	msedge.exe	104
PID 4008 wrote to memory of 1120	4008	guaracha.exe	112
PID 4008 wrote to memory of 6092	4008	guaracha.exe	115
PID 4008 wrote to memory of 3920	4008	guaracha.exe	117
PID 4008 wrote to memory of 5408	4008	guaracha.exe	119
PID 5408 wrote to memory of 4920	5408	MenaceAgent.exe	120
PID 4920 wrote to memory of 5908	4920	MenaceAgent.exe	121
PID 4920 wrote to memory of 5684	4920	MenaceAgent.exe	125
PID 6044 wrote to memory of 540	6044	MicrosoftEdgeUpdate.exe	130
PID 1152 wrote to memory of 5356	1152	MenaceAgent.exe	131
PID 2208 wrote to memory of 4080	2208	msedge.exe	135
PID 2208 wrote to memory of 932	2208	msedge.exe	136
PID 2208 wrote to memory of 1916	2208	msedge.exe	137
PID 2208 wrote to memory of 5908	2208	msedge.exe	138
PID 2208 wrote to memory of 5908	2208	msedge.exe	138
PID 2208 wrote to memory of 5392	2208	msedge.exe	139
PID 2208 wrote to memory of 5392	2208	msedge.exe	139
PID 2208 wrote to memory of 5192	2208	msedge.exe	140
PID 2208 wrote to memory of 5192	2208	msedge.exe	140
PID 2208 wrote to memory of 2724	2208	msedge.exe	141
PID 2208 wrote to memory of 2724	2208	msedge.exe	141
PID 2208 wrote to memory of 2940	2208	msedge.exe	144
PID 2208 wrote to memory of 2940	2208	msedge.exe	144
PID 2208 wrote to memory of 5576	2208	msedge.exe	145
PID 2208 wrote to memory of 5576	2208	msedge.exe	145
PID 2208 wrote to memory of 1592	2208	msedge.exe	146
PID 2208 wrote to memory of 1592	2208	msedge.exe	146
PID 2208 wrote to memory of 5832	2208	msedge.exe	147
PID 2208 wrote to memory of 5832	2208	msedge.exe	147
PID 2208 wrote to memory of 3972	2208	msedge.exe	148
PID 2208 wrote to memory of 3972	2208	msedge.exe	148
PID 2208 wrote to memory of 4360	2208	msedge.exe	149
PID 2208 wrote to memory of 5404	2208	msedge.exe	150
PID 2208 wrote to memory of 5404	2208	msedge.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\guaracha.exe
"C:\Users\Admin\AppData\Local\Temp\guaracha.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Users\Admin\AppData\Local\Temp\guaracha.exe
  "C:\Users\Admin\AppData\Local\Temp\guaracha.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/app
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x304,0x7ffb277ac188,0x7ffb277ac194,0x7ffb277ac1a0
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,8955505830123614581,6309800285227435584,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
      4⤵
      System Time Discovery
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,1707626000478832027,837341406671163413,262144 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
      4⤵
      PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,17344181283555625304,17842263137903127915,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,3554220334913479322,17749419286903019669,2097152 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,17071344025125451378,9733146925569021371,2097152 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4852,i,2401873396818172385,10822695435564379834,2097152 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,4371172100268233462,7133187571582641216,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,13191959029937366476,17637899842761264128,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,10627817807412142362,11194068776244918081,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,10627817807412142362,11194068776244918081,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,9661704786951040033,1885091149704616125,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,1940713886200044493,5526448324098016810,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,6642936835091998006,3660876967590933277,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,8800421165285150962,13717599746020449322,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,1491163491025348425,1449750866269721055,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,6920622849224308517,9273786997850451305,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:8
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,11416151315651133926,14025858523680627881,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,7547012718768019997,4026060604406263377,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,5419318960635209871,886431088267563534,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,13646784604568968286,11337625320200102277,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
      4⤵
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11521406868984860815,18279208821696056199,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:8
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,14540054602361672356,8091961599711713431,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6824,i,705614771561096761,1603314477131338610,262144 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,17834019872576234446,13800657079690563076,524288 --field-trial-handle=2096,i,15499469754066771283,3915935788912686732,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:8
      4⤵
      PID:5404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue).displayName -join ', '"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /f /tn EdgeUpdateCore /sc minute /mo 10 /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe\"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6092
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /f /tn MENACE_UPDATER /sc minute /mo 10 /tr \"C:\Users\Admin\AppData\Local\MENACE_HUB\MenaceAgent.exe\"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3920
- - C:\Users\Admin\AppData\Local\MENACE_HUB\MenaceAgent.exe
    C:\Users\Admin\AppData\Local\MENACE_HUB\MenaceAgent.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Users\Admin\AppData\Local\MENACE_HUB\MenaceAgent.exe
      C:\Users\Admin\AppData\Local\MENACE_HUB\MenaceAgent.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks system information in the registry
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4920
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /f /tn MENACE_UPDATER /sc minute /mo 10 /tr \"C:\Users\Admin\AppData\Local\MENACE_HUB\MenaceAgent.exe\"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5908
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /f /tn EdgeUpdateCore /sc minute /mo 10 /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe\"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4520

C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:540

C:\Users\Admin\AppData\Local\MENACE_HUB\MenaceAgent.exe
"C:\Users\Admin\AppData\Local\MENACE_HUB\MenaceAgent.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\MENACE_HUB\MenaceAgent.exe
  "C:\Users\Admin\AppData\Local\MENACE_HUB\MenaceAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery