donutloader | 3a8b76c8a88ef370afd431332536ca05029fed6fe71f74b3f60ddf02d233cbed

credential_access stealer

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	STFVTXAQDVRANLBN.exe

Uses browser remote debugging 2 TTPs 5 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
4628	msedge.exe
732	msedge.exe
4664	msedge.exe
4952	msedge.exe
2480	msedge.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	STFVTXAQDVRANLBN.exe

Executes dropped EXE 2 IoCs

pid	Process
3040	STFVTXAQDVRANLBN.exe
1744	STFVTXAQDVRANLBN.exe

Loads dropped DLL 2 IoCs

pid	Process
3040	STFVTXAQDVRANLBN.exe
1744	STFVTXAQDVRANLBN.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	STFVTXAQDVRANLBN.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	STFVTXAQDVRANLBN.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Documents\\NBLNARVDQAXTVFTS.vbs"	STFVTXAQDVRANLBN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Documents\\NBLNARVDQAXTVFTS.vbs"	STFVTXAQDVRANLBN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1808	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 1440	3040	STFVTXAQDVRANLBN.exe	99

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1660	cmd.exe
4544	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	STFVTXAQDVRANLBN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	STFVTXAQDVRANLBN.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1032	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{9F1F7241-ECC9-4FE8-B0AA-EA57E5DF6BB3}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\加薪文件.pdf.JS.js:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3040	STFVTXAQDVRANLBN.exe
3040	STFVTXAQDVRANLBN.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	STFVTXAQDVRANLBN.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 1660	3424	wscript.exe	86
PID 3424 wrote to memory of 3040	3424	wscript.exe	88
PID 1808 wrote to memory of 1744	1808	WScript.exe	92
PID 3040 wrote to memory of 4544	3040	STFVTXAQDVRANLBN.exe	96
PID 3040 wrote to memory of 1440	3040	STFVTXAQDVRANLBN.exe	99
PID 4628 wrote to memory of 3880	4628	msedge.exe	104
PID 4628 wrote to memory of 1032	4628	msedge.exe	105
PID 4628 wrote to memory of 2140	4628	msedge.exe	106
PID 4628 wrote to memory of 2140	4628	msedge.exe	106
PID 4628 wrote to memory of 2140	4628	msedge.exe	106
PID 4628 wrote to memory of 4236	4628	msedge.exe	107
PID 4628 wrote to memory of 4236	4628	msedge.exe	107
PID 4628 wrote to memory of 4952	4628	msedge.exe	109
PID 4628 wrote to memory of 4952	4628	msedge.exe	109
PID 4628 wrote to memory of 4952	4628	msedge.exe	109
PID 4628 wrote to memory of 732	4628	msedge.exe	110
PID 4628 wrote to memory of 732	4628	msedge.exe	110
PID 4628 wrote to memory of 732	4628	msedge.exe	110
PID 4628 wrote to memory of 4664	4628	msedge.exe	111
PID 4628 wrote to memory of 4664	4628	msedge.exe	111
PID 4628 wrote to memory of 4664	4628	msedge.exe	111
PID 4628 wrote to memory of 2480	4628	msedge.exe	112
PID 4628 wrote to memory of 2480	4628	msedge.exe	112
PID 4628 wrote to memory of 2480	4628	msedge.exe	112
PID 4628 wrote to memory of 3136	4628	msedge.exe	116
PID 4628 wrote to memory of 3136	4628	msedge.exe	116
PID 4628 wrote to memory of 4016	4628	msedge.exe	117
PID 4628 wrote to memory of 4016	4628	msedge.exe	117
PID 4628 wrote to memory of 4152	4628	msedge.exe	118
PID 4628 wrote to memory of 3832	4628	msedge.exe	119
PID 4628 wrote to memory of 4152	4628	msedge.exe	118
PID 4628 wrote to memory of 3832	4628	msedge.exe	119
PID 4628 wrote to memory of 4784	4628	msedge.exe	124
PID 4628 wrote to memory of 4508	4628	msedge.exe	125
PID 4628 wrote to memory of 4508	4628	msedge.exe	125
PID 4628 wrote to memory of 412	4628	msedge.exe	126
PID 4628 wrote to memory of 412	4628	msedge.exe	126
PID 4628 wrote to memory of 416	4628	msedge.exe	127
PID 4628 wrote to memory of 540	4628	msedge.exe	128
PID 4628 wrote to memory of 416	4628	msedge.exe	127
PID 4628 wrote to memory of 540	4628	msedge.exe	128

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	STFVTXAQDVRANLBN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	STFVTXAQDVRANLBN.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	STFVTXAQDVRANLBN.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\加薪文件.pdf.JS.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\加薪文件.pdf.JS.js:Zone.Identifier"
  2⤵
  - Executes a command shell one-liner
  - NTFS ADS
  PID:1660
- C:\Users\Admin\Documents\STFVTXAQDVRANLBN.exe
  "C:\Users\Admin\Documents\STFVTXAQDVRANLBN.exe" C:\Users\Admin\Documents\NBLNARVDQAXTVFTS
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  - outlook_office_path
  PID:3040
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C
    3⤵
    - Executes a command shell one-liner
    PID:4544
- - C:\Program Files\Google\Chrome\Application\Chrome.exe
    "C:\Program Files\Google\Chrome\Application\Chrome.exe"
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --profile-directory="Default" --remote-debugging-port=9222 --headless
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x268,0x7ffcdf85c188,0x7ffcdf85c194,0x7ffcdf85c1a0
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
      4⤵
      System Time Discovery
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
      4⤵
      PID:412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
      4⤵
      PID:416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TmpUserData" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2040,i,6159350979918357970,7591237262162148434,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
      4⤵
      PID:540

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Documents\NBLNARVDQAXTVFTS.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\Documents\STFVTXAQDVRANLBN.exe
  "C:\Users\Admin\Documents\STFVTXAQDVRANLBN.exe" "C:\Users\Admin\Documents\NBLNARVDQAXTVFTS"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  PID:1744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery