hxxps://yindu[.]tos-cn-hongkong[.]volces[.]com/notis_penalti_cukai%20%283%29[.]html

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\V:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\B:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\K:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\L:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\M:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\O:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\R:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\W:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\X:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\E:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\G:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\J:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\Q:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\U:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\Y:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\I:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\N:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\P:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\S:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\T:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\Z:	NvLocalizedConfig.conf.exe
File opened (read-only)	\??\H:	NvLocalizedConfig.conf.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery defense_evasion

Internet Connection Discovery

T1016.001

flow	ioc
168	api.ipify.org
171	api.ipify.org
174	ip-api.com

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	NvLocalizedConfig.conf.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
972	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5256	4504	WerFault.exe	133

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NvLocalizedConfig.conf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NvLocalizedConfig.conf.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notis_penalti_cukai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvLocalizedConfig.conf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvLocalizedConfig.conf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notis_penalti_cukai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvLocalizedConfig.conf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
2148	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	notis_penalti_cukai.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\text_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.text\ = "text_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ǹ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\text_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\text_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	notis_penalti_cukai.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\앐옆ǹ\ = "text_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\text_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ᡯ⨕먀蠀	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ᡯ⨕먀蠀\ = "text_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\text_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\text_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\text_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{1D738DBF-3149-411A-8AA8-AA4E16442780}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.text	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\ǹ\ = "text_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\앐옆ǹ	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\text_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
988	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe
1280	NvLocalizedConfig.conf.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4040	7zG.exe
1224	7zG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeLoadDriverPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeTakeOwnershipPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeIncBasePriorityPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeTcbPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeRestorePrivilege	4040	7zG.exe
Token: 35	4040	7zG.exe
Token: SeSecurityPrivilege	4040	7zG.exe
Token: SeDebugPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeCreateTokenPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeAssignPrimaryTokenPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeLockMemoryPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeIncreaseQuotaPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeMachineAccountPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeTcbPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeSecurityPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeTakeOwnershipPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeLoadDriverPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeSystemProfilePrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeSystemtimePrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeProfSingleProcessPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeIncBasePriorityPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeCreatePagefilePrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeCreatePermanentPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeBackupPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeRestorePrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeShutdownPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeDebugPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeAuditPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeSystemEnvironmentPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeChangeNotifyPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeRemoteShutdownPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeUndockPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeSyncAgentPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeEnableDelegationPrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeManageVolumePrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeImpersonatePrivilege	1280	NvLocalizedConfig.conf.exe
Token: SeCreateGlobalPrivilege	1280	NvLocalizedConfig.conf.exe
Token: 31	1280	NvLocalizedConfig.conf.exe
Token: 32	1280	NvLocalizedConfig.conf.exe
Token: 33	1280	NvLocalizedConfig.conf.exe
Token: 34	1280	NvLocalizedConfig.conf.exe
Token: 35	1280	NvLocalizedConfig.conf.exe
Token: SeRestorePrivilege	6004	7zG.exe
Token: 35	6004	7zG.exe
Token: SeSecurityPrivilege	6004	7zG.exe
Token: SeSecurityPrivilege	6004	7zG.exe
Token: SeRestorePrivilege	5916	7zG.exe
Token: 35	5916	7zG.exe
Token: SeSecurityPrivilege	5916	7zG.exe
Token: SeBackupPrivilege	5992	svchost.exe
Token: SeRestorePrivilege	5992	svchost.exe
Token: SeSecurityPrivilege	5992	svchost.exe
Token: SeTakeOwnershipPrivilege	5992	svchost.exe
Token: 35	5992	svchost.exe
Token: SeRestorePrivilege	1224	7zG.exe
Token: 35	1224	7zG.exe
Token: SeSecurityPrivilege	1224	7zG.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
4040	7zG.exe
6004	7zG.exe
5916	7zG.exe
1224	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1280	NvLocalizedConfig.conf.exe
2268	OpenWith.exe
888	OpenWith.exe
888	OpenWith.exe
888	OpenWith.exe
888	OpenWith.exe
888	OpenWith.exe
888	OpenWith.exe
888	OpenWith.exe
888	OpenWith.exe
888	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 772	5036	msedge.exe	84
PID 5036 wrote to memory of 2148	5036	msedge.exe	85
PID 5036 wrote to memory of 4984	5036	msedge.exe	86
PID 5036 wrote to memory of 4984	5036	msedge.exe	86
PID 5036 wrote to memory of 4984	5036	msedge.exe	86
PID 5036 wrote to memory of 2000	5036	msedge.exe	88
PID 5036 wrote to memory of 2000	5036	msedge.exe	88
PID 5036 wrote to memory of 2932	5036	msedge.exe	89
PID 5036 wrote to memory of 2932	5036	msedge.exe	89
PID 5036 wrote to memory of 2932	5036	msedge.exe	89
PID 5036 wrote to memory of 4496	5036	msedge.exe	90
PID 5036 wrote to memory of 4496	5036	msedge.exe	90
PID 5036 wrote to memory of 4496	5036	msedge.exe	90
PID 5036 wrote to memory of 4324	5036	msedge.exe	91
PID 5036 wrote to memory of 4324	5036	msedge.exe	91
PID 5036 wrote to memory of 4324	5036	msedge.exe	91
PID 5036 wrote to memory of 3424	5036	msedge.exe	92
PID 5036 wrote to memory of 3424	5036	msedge.exe	92
PID 5036 wrote to memory of 3424	5036	msedge.exe	92
PID 5036 wrote to memory of 4248	5036	msedge.exe	96
PID 5036 wrote to memory of 4248	5036	msedge.exe	96
PID 5036 wrote to memory of 3988	5036	msedge.exe	97
PID 5036 wrote to memory of 3988	5036	msedge.exe	97
PID 5036 wrote to memory of 2864	5036	msedge.exe	98
PID 5036 wrote to memory of 2312	5036	msedge.exe	99
PID 5036 wrote to memory of 2864	5036	msedge.exe	98
PID 5036 wrote to memory of 2312	5036	msedge.exe	99
PID 5036 wrote to memory of 2312	5036	msedge.exe	99
PID 5036 wrote to memory of 1568	5036	msedge.exe	100
PID 5036 wrote to memory of 432	5036	msedge.exe	103
PID 5036 wrote to memory of 4996	5036	msedge.exe	104
PID 5036 wrote to memory of 4996	5036	msedge.exe	104
PID 5036 wrote to memory of 4996	5036	msedge.exe	104
PID 5036 wrote to memory of 2700	5036	msedge.exe	110
PID 5036 wrote to memory of 2700	5036	msedge.exe	110
PID 5036 wrote to memory of 2700	5036	msedge.exe	110
PID 5036 wrote to memory of 2208	5036	msedge.exe	113
PID 5036 wrote to memory of 2208	5036	msedge.exe	113
PID 5036 wrote to memory of 2208	5036	msedge.exe	113
PID 5036 wrote to memory of 4456	5036	msedge.exe	114
PID 5036 wrote to memory of 1308	5036	msedge.exe	118
PID 5036 wrote to memory of 2504	5036	msedge.exe	119
PID 5036 wrote to memory of 1324	5036	msedge.exe	120
PID 816 wrote to memory of 1280	816	notis_penalti_cukai.exe	123
PID 5036 wrote to memory of 3540	5036	msedge.exe	126
PID 5036 wrote to memory of 3540	5036	msedge.exe	126
PID 5036 wrote to memory of 3540	5036	msedge.exe	126
PID 1280 wrote to memory of 972	1280	NvLocalizedConfig.conf.exe	127
PID 972 wrote to memory of 3996	972	cmd.exe	128
PID 5036 wrote to memory of 3628	5036	msedge.exe	129
PID 5036 wrote to memory of 3628	5036	msedge.exe	129
PID 5036 wrote to memory of 3628	5036	msedge.exe	129
PID 5036 wrote to memory of 4212	5036	msedge.exe	131
PID 5036 wrote to memory of 4212	5036	msedge.exe	131
PID 5036 wrote to memory of 4212	5036	msedge.exe	131
PID 5036 wrote to memory of 2504	5036	msedge.exe	134
PID 5036 wrote to memory of 2504	5036	msedge.exe	134
PID 5036 wrote to memory of 5828	5036	msedge.exe	138
PID 5036 wrote to memory of 5828	5036	msedge.exe	138
PID 5036 wrote to memory of 5828	5036	msedge.exe	138
PID 5036 wrote to memory of 4868	5036	msedge.exe	139
PID 5036 wrote to memory of 4868	5036	msedge.exe	139
PID 5036 wrote to memory of 4868	5036	msedge.exe	139
PID 5036 wrote to memory of 5788	5036	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://yindu.tos-cn-hongkong.volces.com/notis_penalti_cukai%20%283%29.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffbacf6c188,0x7ffbacf6c194,0x7ffbacf6c1a0
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,8327049468192790163,10265798141283403646,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,8176849225381305520,2700062584228320085,262144 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,7627496937949166197,8317233937617158275,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,5893710124746470361,17826422048799939808,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,2094976893185196929,1800529119750661838,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,3098789885179501388,10379703157844617214,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,10864996492229777463,4763460948109068413,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:2
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,11041631389377517981,750551470471862848,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,14898564233074891137,4571687635110180514,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,1942206416134442539,14669314923869318300,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5736,i,5360300727433188362,943590358624586207,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,4736829085097112752,12359408071535863890,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,9620868272879208733,6321237864883179332,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,9620868272879208733,6321237864883179332,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6872,i,11390693210080242510,16237397976417701670,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7104,i,3101884751444850415,6231243490731675546,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4412,i,56211219591005985,741257554771684177,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,9853442064310320991,15949362859473325049,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,8589344241421388716,1674257694598113927,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,5115853580847924469,16752538287186787477,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,9621528563404083507,2040675632246431283,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5808,i,4159442640044876526,15925800632498484236,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5856,i,10257882238958982433,16629509950213426384,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7360,i,11273481466508300342,805757953479271289,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,6627010419595727202,4337913918215778197,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6956,i,11895960414591970069,17340528287324680341,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6948,i,16092928040602551748,4451122748240416986,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7540,i,14752821223867870581,13353022101967991260,2097152 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,15218744252107925597,12982177098495694610,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6036,i,15970088607883811372,13669105577659932313,262144 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,17057461069220793657,4227857469016741308,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,13699786657669861712,12429215909671353404,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,6552805276092615236,14647032903156902474,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,14903334981490166951,17625954291447911164,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7884,i,14977953224063719891,17860692456935930623,524288 --field-trial-handle=2352,i,8626964461415748762,6625645863248658368,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3240

C:\Users\Admin\Downloads\notis_penalti_cukai\notis_penalti_cukai.exe
"C:\Users\Admin\Downloads\notis_penalti_cukai\notis_penalti_cukai.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Public\7~@'$.Ynb_\NvLocalizedConfig.conf.exe
  "C:\Users\Public\7~@'$.Ynb_\NvLocalizedConfig.conf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\Public\7~@'$.Ynb_\CTXMUI.dll",NvIGOUtil "C:\Users\Public\7~@'$.Ynb_\NvLocalizedConfig.conf.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\Public\7~@'$.Ynb_\CTXMUI.dll",NvIGOUtil "C:\Users\Public\7~@'$.Ynb_\NvLocalizedConfig.conf.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3996

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" h -scrcSHA256 -i#7zMap16777:140:7zEvent916
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4040

C:\Users\Public\7~@'$.Ynb_\NvLocalizedConfig.conf.exe
C:\Users\Public\7~@'$.Ynb_\NvLocalizedConfig.conf.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 596
  2⤵
  - Program crash
  PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4504 -ip 4504
1⤵
PID:5208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2268

C:\Users\Admin\Downloads\notis_penalti_cukai\notis_penalti_cukai.exe
"C:\Users\Admin\Downloads\notis_penalti_cukai\notis_penalti_cukai.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5720
- C:\Users\Public\3~&().ByV_\NvLocalizedConfig.conf.exe
  "C:\Users\Public\3~&().ByV_\NvLocalizedConfig.conf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5808

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\notis_penalti_cukai\" -an -ai#7zMap29339:140:7zEvent20955
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:888
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\notis_penalti_cukai\.text
  2⤵
  PID:5304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:1680

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\cv_debug.log
1⤵
- Opens file in notepad (likely ransom note)
PID:988

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\notis_penalti_cukai\ctxMUI\" -ad -an -ai#7zMap15909:114:7zEvent18323
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5992

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" h -scrcSHA256 -i#7zMap30533:114:7zEvent11518
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery