overlord | 84d29ba33e7cadc5e3b879ca629547e2e00c6728cabe62887cba500f8571588f

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
119	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5544 set thread context of 1344	5544	VideoProc9.exe	134

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_489943912\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_407559827\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_264951261\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_419571881\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_489943912\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\bn\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9DA93304-F098-4A99-A65C-3D59799D8849}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6C0B3429D1A36C5C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\hi\messages.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_489943912\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\kk\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\e593f13.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI430A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2956_219221256\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1841734817\_locales\ar\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
260	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
3232	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\WOW6432Node\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\WOW6432Node\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}\wde72 = "FILE:C:\\Users\\Admin\\AppData\\Local\\Shared\\04fa8a72"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\WOW6432Node\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\WOW6432Node\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}\wdd3e = "FILE:C:\\Users\\Admin\\AppData\\Local\\Helpers\\c44cc00c"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}	VideoProc9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}\wde72 = "FILE:C:\\Users\\Admin\\AppData\\Local\\Shared\\04fa8a72"	VideoProc9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}\w5a78 = "FILE:C:\\Users\\Admin\\AppData\\Local\\Core\\a109dcb6"	VideoProc9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}\wdd3e = "FILE:C:\\Users\\Admin\\AppData\\Local\\Helpers\\c44cc00c"	VideoProc9.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\WOW6432Node\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\WOW6432Node\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}\w5a78 = "FILE:C:\\Users\\Admin\\AppData\\Local\\Core\\a109dcb6"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{BC809E4B-78A4-4C2C-A3C2-1780FC41F12D}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{21E97476-4E3D-41B3-B85B-A52390B47537}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
364	schtasks.exe
4952	schtasks.exe
4272	schtasks.exe
1944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2436	rundll32.exe
2436	rundll32.exe
2436	rundll32.exe
2436	rundll32.exe
2436	rundll32.exe
2436	rundll32.exe
2268	msiexec.exe
2268	msiexec.exe
5544	VideoProc9.exe
5544	VideoProc9.exe
2436	rundll32.exe
2436	rundll32.exe
2436	rundll32.exe
2436	rundll32.exe
2652	msedge.exe
2652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5476	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5476	msiexec.exe
Token: SeSecurityPrivilege	2268	msiexec.exe
Token: SeCreateTokenPrivilege	5476	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5476	msiexec.exe
Token: SeLockMemoryPrivilege	5476	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5476	msiexec.exe
Token: SeMachineAccountPrivilege	5476	msiexec.exe
Token: SeTcbPrivilege	5476	msiexec.exe
Token: SeSecurityPrivilege	5476	msiexec.exe
Token: SeTakeOwnershipPrivilege	5476	msiexec.exe
Token: SeLoadDriverPrivilege	5476	msiexec.exe
Token: SeSystemProfilePrivilege	5476	msiexec.exe
Token: SeSystemtimePrivilege	5476	msiexec.exe
Token: SeProfSingleProcessPrivilege	5476	msiexec.exe
Token: SeIncBasePriorityPrivilege	5476	msiexec.exe
Token: SeCreatePagefilePrivilege	5476	msiexec.exe
Token: SeCreatePermanentPrivilege	5476	msiexec.exe
Token: SeBackupPrivilege	5476	msiexec.exe
Token: SeRestorePrivilege	5476	msiexec.exe
Token: SeShutdownPrivilege	5476	msiexec.exe
Token: SeDebugPrivilege	5476	msiexec.exe
Token: SeAuditPrivilege	5476	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5476	msiexec.exe
Token: SeChangeNotifyPrivilege	5476	msiexec.exe
Token: SeRemoteShutdownPrivilege	5476	msiexec.exe
Token: SeUndockPrivilege	5476	msiexec.exe
Token: SeSyncAgentPrivilege	5476	msiexec.exe
Token: SeEnableDelegationPrivilege	5476	msiexec.exe
Token: SeManageVolumePrivilege	5476	msiexec.exe
Token: SeImpersonatePrivilege	5476	msiexec.exe
Token: SeCreateGlobalPrivilege	5476	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeRestorePrivilege	2268	msiexec.exe
Token: SeTakeOwnershipPrivilege	2268	msiexec.exe
Token: SeDebugPrivilege	5544	VideoProc9.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5476	msiexec.exe
2268	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 5476	2436	rundll32.exe	89
PID 2436 wrote to memory of 2956	2436	rundll32.exe	91
PID 2268 wrote to memory of 260	2268	msiexec.exe	92
PID 2956 wrote to memory of 2440	2956	msedge.exe	94
PID 260 wrote to memory of 5636	260	cmd.exe	95
PID 2956 wrote to memory of 3232	2956	msedge.exe	97
PID 2956 wrote to memory of 1508	2956	msedge.exe	98
PID 2956 wrote to memory of 1508	2956	msedge.exe	98
PID 2956 wrote to memory of 3724	2956	msedge.exe	99
PID 2956 wrote to memory of 3724	2956	msedge.exe	99
PID 2956 wrote to memory of 3724	2956	msedge.exe	99
PID 2956 wrote to memory of 4596	2956	msedge.exe	100
PID 2956 wrote to memory of 5980	2956	msedge.exe	101
PID 2956 wrote to memory of 4596	2956	msedge.exe	100
PID 2956 wrote to memory of 4596	2956	msedge.exe	100
PID 2956 wrote to memory of 5980	2956	msedge.exe	101
PID 2956 wrote to memory of 5980	2956	msedge.exe	101
PID 2956 wrote to memory of 2608	2956	msedge.exe	102
PID 2956 wrote to memory of 5172	2956	msedge.exe	103
PID 2956 wrote to memory of 2608	2956	msedge.exe	102
PID 2956 wrote to memory of 2608	2956	msedge.exe	102
PID 2956 wrote to memory of 5172	2956	msedge.exe	103
PID 2956 wrote to memory of 5172	2956	msedge.exe	103
PID 260 wrote to memory of 3464	260	cmd.exe	104
PID 260 wrote to memory of 4952	260	cmd.exe	105
PID 2956 wrote to memory of 3500	2956	msedge.exe	107
PID 2956 wrote to memory of 3500	2956	msedge.exe	107
PID 260 wrote to memory of 4272	260	cmd.exe	108
PID 260 wrote to memory of 2116	260	cmd.exe	111
PID 2956 wrote to memory of 1348	2956	msedge.exe	112
PID 2956 wrote to memory of 1348	2956	msedge.exe	112
PID 2956 wrote to memory of 1348	2956	msedge.exe	112
PID 2956 wrote to memory of 5804	2956	msedge.exe	115
PID 2956 wrote to memory of 5804	2956	msedge.exe	115
PID 2956 wrote to memory of 2924	2956	msedge.exe	116
PID 2956 wrote to memory of 2924	2956	msedge.exe	116
PID 2956 wrote to memory of 1328	2956	msedge.exe	117
PID 2956 wrote to memory of 1328	2956	msedge.exe	117
PID 2956 wrote to memory of 1328	2956	msedge.exe	117
PID 260 wrote to memory of 1416	260	cmd.exe	118
PID 2956 wrote to memory of 4520	2956	msedge.exe	119
PID 2956 wrote to memory of 4520	2956	msedge.exe	119
PID 5544 wrote to memory of 1944	5544	VideoProc9.exe	120
PID 5544 wrote to memory of 364	5544	VideoProc9.exe	122
PID 260 wrote to memory of 6108	260	cmd.exe	124
PID 260 wrote to memory of 6032	260	cmd.exe	125
PID 2268 wrote to memory of 1128	2268	msiexec.exe	126
PID 2956 wrote to memory of 2504	2956	msedge.exe	128
PID 2956 wrote to memory of 3892	2956	msedge.exe	130
PID 2956 wrote to memory of 5332	2956	msedge.exe	131
PID 2956 wrote to memory of 5332	2956	msedge.exe	131
PID 2956 wrote to memory of 1744	2956	msedge.exe	132
PID 2956 wrote to memory of 1744	2956	msedge.exe	132
PID 5544 wrote to memory of 1344	5544	VideoProc9.exe	134
PID 2956 wrote to memory of 4636	2956	msedge.exe	136
PID 2956 wrote to memory of 4636	2956	msedge.exe	136
PID 2956 wrote to memory of 200	2956	msedge.exe	138
PID 2956 wrote to memory of 200	2956	msedge.exe	138
PID 2956 wrote to memory of 5284	2956	msedge.exe	139
PID 2956 wrote to memory of 4768	2956	msedge.exe	140
PID 2956 wrote to memory of 3772	2956	msedge.exe	141
PID 2956 wrote to memory of 1832	2956	msedge.exe	142
PID 2956 wrote to memory of 1832	2956	msedge.exe	142
PID 2956 wrote to memory of 4928	2956	msedge.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4316
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Noise+.dll,#1
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\msiexec.exe
    msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\setup.msi" /quiet /qn /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/7AIbj9fCfSI
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffb1c3ec188,0x7ffb1c3ec194,0x7ffb1c3ec1a0
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,16881112659974265048,18256977217799017725,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
      4⤵
      System Time Discovery
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,6303000187389307433,15933078751162286819,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:13
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,13422439155648985291,16053029221781439365,262144 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,11575893766414772050,11459135007278368620,2097152 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,7896950870811250210,11811747841940102015,2097152 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,6825668006783865984,15073985282610732010,2097152 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,12351820263761497952,5580446633362076349,2097152 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:9
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,10265002144374876737,4676192546465966405,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5364,i,11770436941690228319,15510680751968846860,2097152 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,166995980275030753,12541637947968176628,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,15687508303712329020,2644420599861738392,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5852,i,10777500564732941968,15763252734085691699,2097152 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,8346480246379544690,17611855986160365637,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:12
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,14701711187027436723,13276766201581319525,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      Modifies registry class
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,5978979331766158761,4116935042025008494,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,5978979331766158761,4116935042025008494,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,11448140208408320407,15416593973047778497,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,14915339120659372572,17907269746976448641,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
      4⤵
      PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,15969317098523302050,17742020127123839995,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,14219333397076800859,16462774913615323914,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,12679887345530946807,17141818455557344538,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,8960144040432869452,6487325254945369447,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,13607710899998879839,13947314859812251516,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,7599833261991249569,11692975757307293464,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,17540968336166391234,18156355289315355220,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,7572214792955060154,16795723327232544465,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:14
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,3852672986680076183,7827678156536464593,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7072,i,6515026043926930207,2314019569392195366,262144 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,12046417450931272928,3446054959690702719,524288 --field-trial-handle=2304,i,1237226355655357572,16217874556502574734,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:14
      4⤵
      PID:3732
- C:\Windows\System32\WerFault.exe
  "C:\Windows\System32\WerFault.exe" -u -p 5544 -s 240743078
  2⤵
  - Checks processor information in registry
  PID:1344

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Shared\04fa8a72\RegisterAgent.cmd""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy /E /I /Y /Q /H /R "C:\Users\Admin\AppData\Local\Shared\04fa8a72\*" "C:\Users\Admin\AppData\Local\Core\a109dcb6\"
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:5636
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy /E /I /Y /Q /H /R "C:\Users\Admin\AppData\Local\Shared\04fa8a72\*" "C:\Users\Admin\AppData\Local\Helpers\c44cc00c\"
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:3464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN "AutoBroker569538d1" /XML "C:\Users\Admin\AppData\Local\Temp\r2479.xml" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN "SyncAgentdc2dacc4" /XML "C:\Users\Admin\AppData\Local\Temp\r2479.xml" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4272
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Local\Helpers\c44cc00c\VideoProc9.exe" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    - System Location Discovery: System Language Discovery
    PID:2116
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}" /v wde72 /t REG_SZ /d "FILE:C:\Users\Admin\AppData\Local\Shared\04fa8a72" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1416
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}" /v w5a78 /t REG_SZ /d "FILE:C:\Users\Admin\AppData\Local\Core\a109dcb6" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:6108
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}" /v wdd3e /t REG_SZ /d "FILE:C:\Users\Admin\AppData\Local\Helpers\c44cc00c" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:6032
- C:\Users\Admin\AppData\Local\Shared\04fa8a72\VideoProc9.exe
  "C:\Users\Admin\AppData\Local\Shared\04fa8a72\VideoProc9.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4664

C:\Users\Admin\AppData\Local\Shared\04fa8a72\VideoProc9.exe
C:\Users\Admin\AppData\Local\Shared\04fa8a72\VideoProc9.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN "AutoBroker569538d1" /XML "C:\Users\Admin\AppData\Local\Temp\AutoBroker569538d1.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1944
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /TN "SyncAgentdc2dacc4" /XML "C:\Users\Admin\AppData\Local\Temp\SyncAgentdc2dacc4.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:364

C:\Users\Admin\AppData\Local\Core\a109dcb6\VideoProc9.exe
C:\Users\Admin\AppData\Local\Core\a109dcb6\VideoProc9.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery