hxxp://www[.]hingeparty[.]com

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	javaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	javaw.exe

Executes dropped EXE 14 IoCs

pid	Process
1232	HingeAPP.exe
3832	Application.exe
3340	Application.exe
6504	javaw.exe
6524	Application.exe
5276	Application.exe
5416	Application.exe
3564	Application.exe
3360	Application.exe
5772	javaw.exe
5416	Application.exe
5996	Application.exe
5976	javaw.exe
6084	Application.exe

Loads dropped DLL 64 IoCs

pid	Process
1232	HingeAPP.exe
1232	HingeAPP.exe
1232	HingeAPP.exe
1232	HingeAPP.exe
1232	HingeAPP.exe
1232	HingeAPP.exe
1232	HingeAPP.exe
3832	Application.exe
3340	Application.exe
3340	Application.exe
3340	Application.exe
3340	Application.exe
3340	Application.exe
3340	Application.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6524	Application.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
5276	Application.exe
5416	Application.exe
5416	Application.exe
5416	Application.exe
5416	Application.exe
5416	Application.exe
5416	Application.exe
3564	Application.exe
3360	Application.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
5772	javaw.exe
5772	javaw.exe
5772	javaw.exe
5772	javaw.exe
5772	javaw.exe
5772	javaw.exe
5772	javaw.exe
5772	javaw.exe
5772	javaw.exe
5772	javaw.exe
5772	javaw.exe
5416	Application.exe
5996	Application.exe
5996	Application.exe
5996	Application.exe
5996	Application.exe
5996	Application.exe
5996	Application.exe
5976	javaw.exe
5976	javaw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JavaUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\java\\java\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Local\\java\\app.jar\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JavaUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\java\\java\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Local\\java\\app.jar\""	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
165	discord.com
166	discord.com
169	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
117	ipapi.co
118	ipapi.co
119	ipapi.co

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
6556	tasklist.exe
6564	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
608	cmd.exe
1464	cmd.exe
5072	cmd.exe
5864	cmd.exe
1320	cmd.exe
3976	cmd.exe
2712	cmd.exe
3448	cmd.exe
3484	cmd.exe
4384	cmd.exe
6524	cmd.exe
412	cmd.exe
2900	cmd.exe
4400	cmd.exe
5180	cmd.exe
5316	cmd.exe
4224	cmd.exe
6472	cmd.exe
5852	cmd.exe
2212	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Application.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Application.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Application.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Application.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Application.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Application.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Application.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Application.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Application.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Application.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Application.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Application.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HingeAPP.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
1032	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
6912	wmic.exe
5284	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 18 IoCs

defense_evasion

pid	Process
6792	taskkill.exe
1352	taskkill.exe
6784	taskkill.exe
4984	taskkill.exe
5260	taskkill.exe
6856	taskkill.exe
3328	taskkill.exe
2304	taskkill.exe
6380	taskkill.exe
6116	taskkill.exe
3352	taskkill.exe
6944	taskkill.exe
2368	taskkill.exe
1164	taskkill.exe
960	taskkill.exe
1332	taskkill.exe
5224	taskkill.exe
7052	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{E47D187B-DFC4-4F21-8407-1110013DEB77}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1232	HingeAPP.exe
1232	HingeAPP.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
6504	javaw.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2236	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1232	HingeAPP.exe
Token: SeShutdownPrivilege	3832	Application.exe
Token: SeCreatePagefilePrivilege	3832	Application.exe
Token: SeShutdownPrivilege	3832	Application.exe
Token: SeCreatePagefilePrivilege	3832	Application.exe
Token: SeIncreaseQuotaPrivilege	6912	wmic.exe
Token: SeSecurityPrivilege	6912	wmic.exe
Token: SeTakeOwnershipPrivilege	6912	wmic.exe
Token: SeLoadDriverPrivilege	6912	wmic.exe
Token: SeSystemProfilePrivilege	6912	wmic.exe
Token: SeSystemtimePrivilege	6912	wmic.exe
Token: SeProfSingleProcessPrivilege	6912	wmic.exe
Token: SeIncBasePriorityPrivilege	6912	wmic.exe
Token: SeCreatePagefilePrivilege	6912	wmic.exe
Token: SeBackupPrivilege	6912	wmic.exe
Token: SeRestorePrivilege	6912	wmic.exe
Token: SeShutdownPrivilege	6912	wmic.exe
Token: SeDebugPrivilege	6912	wmic.exe
Token: SeSystemEnvironmentPrivilege	6912	wmic.exe
Token: SeRemoteShutdownPrivilege	6912	wmic.exe
Token: SeUndockPrivilege	6912	wmic.exe
Token: SeManageVolumePrivilege	6912	wmic.exe
Token: 33	6912	wmic.exe
Token: 34	6912	wmic.exe
Token: 35	6912	wmic.exe
Token: 36	6912	wmic.exe
Token: SeIncreaseQuotaPrivilege	6912	wmic.exe
Token: SeSecurityPrivilege	6912	wmic.exe
Token: SeTakeOwnershipPrivilege	6912	wmic.exe
Token: SeLoadDriverPrivilege	6912	wmic.exe
Token: SeSystemProfilePrivilege	6912	wmic.exe
Token: SeSystemtimePrivilege	6912	wmic.exe
Token: SeProfSingleProcessPrivilege	6912	wmic.exe
Token: SeIncBasePriorityPrivilege	6912	wmic.exe
Token: SeCreatePagefilePrivilege	6912	wmic.exe
Token: SeBackupPrivilege	6912	wmic.exe
Token: SeRestorePrivilege	6912	wmic.exe
Token: SeShutdownPrivilege	6912	wmic.exe
Token: SeDebugPrivilege	6912	wmic.exe
Token: SeSystemEnvironmentPrivilege	6912	wmic.exe
Token: SeRemoteShutdownPrivilege	6912	wmic.exe
Token: SeUndockPrivilege	6912	wmic.exe
Token: SeManageVolumePrivilege	6912	wmic.exe
Token: 33	6912	wmic.exe
Token: 34	6912	wmic.exe
Token: 35	6912	wmic.exe
Token: 36	6912	wmic.exe
Token: SeDebugPrivilege	6564	tasklist.exe
Token: SeDebugPrivilege	2236	taskmgr.exe
Token: SeSystemProfilePrivilege	2236	taskmgr.exe
Token: SeCreateGlobalPrivilege	2236	taskmgr.exe
Token: SeDebugPrivilege	6792	taskkill.exe
Token: SeDebugPrivilege	960	taskkill.exe
Token: SeDebugPrivilege	1332	taskkill.exe
Token: SeDebugPrivilege	3328	taskkill.exe
Token: SeDebugPrivilege	5224	taskkill.exe
Token: SeDebugPrivilege	6116	taskkill.exe
Token: SeDebugPrivilege	1352	taskkill.exe
Token: SeDebugPrivilege	3352	taskkill.exe
Token: SeDebugPrivilege	2304	taskkill.exe
Token: SeShutdownPrivilege	5416	Application.exe
Token: SeCreatePagefilePrivilege	5416	Application.exe
Token: SeIncreaseQuotaPrivilege	5284	wmic.exe
Token: SeSecurityPrivilege	5284	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6504	javaw.exe
5976	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 4732	2184	msedge.exe	84
PID 2184 wrote to memory of 1032	2184	msedge.exe	85
PID 2184 wrote to memory of 4516	2184	msedge.exe	86
PID 2184 wrote to memory of 4516	2184	msedge.exe	86
PID 2184 wrote to memory of 4516	2184	msedge.exe	86
PID 2184 wrote to memory of 456	2184	msedge.exe	87
PID 2184 wrote to memory of 456	2184	msedge.exe	87
PID 2184 wrote to memory of 4936	2184	msedge.exe	88
PID 2184 wrote to memory of 4936	2184	msedge.exe	88
PID 2184 wrote to memory of 2320	2184	msedge.exe	89
PID 2184 wrote to memory of 4936	2184	msedge.exe	88
PID 2184 wrote to memory of 2320	2184	msedge.exe	89
PID 2184 wrote to memory of 2320	2184	msedge.exe	89
PID 2184 wrote to memory of 2580	2184	msedge.exe	91
PID 2184 wrote to memory of 3328	2184	msedge.exe	92
PID 2184 wrote to memory of 2580	2184	msedge.exe	91
PID 2184 wrote to memory of 2580	2184	msedge.exe	91
PID 2184 wrote to memory of 3328	2184	msedge.exe	92
PID 2184 wrote to memory of 3328	2184	msedge.exe	92
PID 2184 wrote to memory of 1992	2184	msedge.exe	95
PID 2184 wrote to memory of 1992	2184	msedge.exe	95
PID 2184 wrote to memory of 1992	2184	msedge.exe	95
PID 2184 wrote to memory of 1452	2184	msedge.exe	98
PID 2184 wrote to memory of 1452	2184	msedge.exe	98
PID 2184 wrote to memory of 1452	2184	msedge.exe	98
PID 2184 wrote to memory of 3388	2184	msedge.exe	99
PID 2184 wrote to memory of 3448	2184	msedge.exe	100
PID 2184 wrote to memory of 3388	2184	msedge.exe	99
PID 2184 wrote to memory of 3448	2184	msedge.exe	100
PID 2184 wrote to memory of 4336	2184	msedge.exe	103
PID 2184 wrote to memory of 4536	2184	msedge.exe	109
PID 2184 wrote to memory of 4536	2184	msedge.exe	109
PID 2184 wrote to memory of 4536	2184	msedge.exe	109
PID 2184 wrote to memory of 4252	2184	msedge.exe	114
PID 2184 wrote to memory of 4252	2184	msedge.exe	114
PID 2184 wrote to memory of 4252	2184	msedge.exe	114
PID 2184 wrote to memory of 4232	2184	msedge.exe	117
PID 2184 wrote to memory of 1216	2184	msedge.exe	118
PID 2184 wrote to memory of 3296	2184	msedge.exe	119
PID 2184 wrote to memory of 3972	2184	msedge.exe	120
PID 2184 wrote to memory of 3972	2184	msedge.exe	120
PID 2184 wrote to memory of 3972	2184	msedge.exe	120
PID 2184 wrote to memory of 2212	2184	msedge.exe	121
PID 2184 wrote to memory of 2212	2184	msedge.exe	121
PID 2184 wrote to memory of 1476	2184	msedge.exe	122
PID 2184 wrote to memory of 1476	2184	msedge.exe	122
PID 2184 wrote to memory of 1476	2184	msedge.exe	122
PID 2184 wrote to memory of 3516	2184	msedge.exe	124
PID 2184 wrote to memory of 1232	2184	msedge.exe	125
PID 2184 wrote to memory of 4520	2184	msedge.exe	127
PID 2184 wrote to memory of 4520	2184	msedge.exe	127
PID 3832 wrote to memory of 3340	3832	Application.exe	130
PID 3832 wrote to memory of 3340	3832	Application.exe	130
PID 3832 wrote to memory of 6504	3832	Application.exe	131
PID 3832 wrote to memory of 6524	3832	Application.exe	132
PID 6504 wrote to memory of 6912	6504	javaw.exe	134
PID 6504 wrote to memory of 6564	6504	javaw.exe	136
PID 6504 wrote to memory of 5168	6504	javaw.exe	139
PID 6504 wrote to memory of 5168	6504	javaw.exe	139
PID 6504 wrote to memory of 5168	6504	javaw.exe	139
PID 6504 wrote to memory of 5168	6504	javaw.exe	139
PID 6504 wrote to memory of 5168	6504	javaw.exe	139
PID 6504 wrote to memory of 5168	6504	javaw.exe	139
PID 6504 wrote to memory of 5168	6504	javaw.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.hingeparty.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffd1508c188,0x7ffd1508c194,0x7ffd1508c1a0
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,7884801981459425577,11034794894074092683,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,1153519621587967387,1289872697983630731,262144 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,3969704422658821184,5758076898466653717,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,8294256209783048905,7372242390241800752,2097152 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,6632538441405840572,15145060867291419794,2097152 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,3897470815270938628,5757546361101080059,2097152 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,17971693421901920975,6139269624488339803,2097152 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3636,i,2072998787236830528,15323189058673470005,2097152 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5296,i,16423262077289901918,383611507816568391,2097152 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,11482875118454468207,8185638095896807423,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,126388295921239224,12423378104249326871,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,6110630239142909656,11739943479269078046,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,6110630239142909656,11739943479269078046,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6244,i,7154980492385633471,4402368652390501052,2097152 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4340,i,11516759464254833812,9047010439812069607,2097152 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,2611976572927443982,85488150834333039,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,15464860145203560353,2446123386181415848,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,10112955083574229699,5608437148360799541,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5192,i,14390336666158377073,6979292733305343972,2097152 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,15983797224368965007,10487567477657647280,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4848,i,13624885451016113788,3871046194227137631,2097152 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,17545076418003490542,14378942859664910187,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:3516
- C:\Users\Admin\Downloads\HingeAPP.exe
  "C:\Users\Admin\Downloads\HingeAPP.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,7414072915729878737,293527271016056624,524288 --field-trial-handle=2368,i,473362884613229604,7880986829824644736,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4384

C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe
"C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe
  "C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\los8ryts3" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1776,i,7280103054158973991,1547610988219975870,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3340
- C:\Users\Admin\AppData\Local\java\java\bin\javaw.exe
  C:\Users\Admin\AppData\Local\java\java\bin\javaw.exe -jar C:\Users\Admin\AppData\Local\java\app.jar
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6504
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:6912
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /NH /FO CSV
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5696
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM firefox.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:5864
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6792
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM palemoon.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:4384
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM palemoon.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:960
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM basilisk.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:2212
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM basilisk.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1332
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM seamonkey.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:1320
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM seamonkey.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3328
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM icedragon.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:3976
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM icedragon.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5224
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM waterfox.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:5180
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM waterfox.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6116
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM librewolf.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:5316
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM librewolf.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1352
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM zen.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:4224
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM zen.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3352
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM floorp.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:608
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM floorp.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2304
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JavaUpdate" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\java\java\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\java\app.jar\"" /f"
    3⤵
    - Executes a command shell one-liner
    PID:2712
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JavaUpdate" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\java\java\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\java\app.jar\"" /f
      4⤵
      Adds Run key to start application
      PID:5452
- C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe
  "C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\los8ryts3" --mojo-platform-channel-handle=1964 --field-trial-handle=1776,i,7280103054158973991,1547610988219975870,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  PID:6524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5312

C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe
"C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:5276
- C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe
  "C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\los8ryts3" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1328,i,11849649419491491517,8726963775049504968,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5416

C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe
"C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:3564
- C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe
  "C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\los8ryts3" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1732,i,17884255443613902367,6361090361162799410,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3360

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2236

C:\Users\Admin\AppData\Local\java\java\bin\javaw.exe
"C:\Users\Admin\AppData\Local\java\java\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\java\app.jar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:5772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5360

C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe
"C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5416
- C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe
  "C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\los8ryts3" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1796,i,5432661278180049285,11352301611925017997,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5996
- C:\Users\Admin\AppData\Local\java\java\bin\javaw.exe
  C:\Users\Admin\AppData\Local\java\java\bin\javaw.exe -jar C:\Users\Admin\AppData\Local\java\app.jar
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:5976
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:5284
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /NH /FO CSV
    3⤵
    - Discovers running processes
    PID:6556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5820
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM firefox.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:6524
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:6784
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM palemoon.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:3448
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM palemoon.exe /T
      4⤵
      Kills process with taskkill
      PID:6380
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM basilisk.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:1464
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM basilisk.exe /T
      4⤵
      Kills process with taskkill
      PID:4984
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM seamonkey.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:412
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM seamonkey.exe /T
      4⤵
      Kills process with taskkill
      PID:5260
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM icedragon.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:6472
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM icedragon.exe /T
      4⤵
      Kills process with taskkill
      PID:6856
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM waterfox.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:2900
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM waterfox.exe /T
      4⤵
      Kills process with taskkill
      PID:7052
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM librewolf.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:3484
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM librewolf.exe /T
      4⤵
      Kills process with taskkill
      PID:6944
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM zen.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:5852
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM zen.exe /T
      4⤵
      Kills process with taskkill
      PID:2368
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /F /IM floorp.exe /T"
    3⤵
    - Executes a command shell one-liner
    PID:5072
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM floorp.exe /T
      4⤵
      Kills process with taskkill
      PID:1164
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JavaUpdate" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\java\java\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\java\app.jar\"" /f"
    3⤵
    - Executes a command shell one-liner
    PID:4400
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JavaUpdate" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\java\java\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\java\app.jar\"" /f
      4⤵
      Adds Run key to start application
      PID:3024
- C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe
  "C:\Users\Admin\AppData\Local\Programs\los8ryts3\Application.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\los8ryts3" --mojo-platform-channel-handle=2000 --field-trial-handle=1796,i,5432661278180049285,11352301611925017997,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:6084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery