dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe

Executes dropped EXE 1 IoCs

pid	Process
1628	__abeh_5012.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
38	ip-api.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\__abeh_5012.exe	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3528_1618767070\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3528_394212975\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3528_1702642361\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3528_1702642361\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\__abeh_5012.exe	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3528_394212975\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3528_407833395\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3528_407833395\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3528_1702642361\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3528_1702642361\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4672	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{9B887F40-5D65-4D04-86D2-862980E74095}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5012	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe
5012	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe
4900	msedge.exe
4900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 3528	5012	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe	85
PID 3528 wrote to memory of 4800	3528	msedge.exe	86
PID 3528 wrote to memory of 4672	3528	msedge.exe	87
PID 3528 wrote to memory of 1888	3528	msedge.exe	88
PID 3528 wrote to memory of 1888	3528	msedge.exe	88
PID 3528 wrote to memory of 1888	3528	msedge.exe	88
PID 3528 wrote to memory of 3804	3528	msedge.exe	89
PID 3528 wrote to memory of 3804	3528	msedge.exe	89
PID 3528 wrote to memory of 1600	3528	msedge.exe	91
PID 3528 wrote to memory of 4832	3528	msedge.exe	92
PID 3528 wrote to memory of 1600	3528	msedge.exe	91
PID 3528 wrote to memory of 1600	3528	msedge.exe	91
PID 3528 wrote to memory of 4832	3528	msedge.exe	92
PID 3528 wrote to memory of 4832	3528	msedge.exe	92
PID 3528 wrote to memory of 3296	3528	msedge.exe	93
PID 3528 wrote to memory of 3296	3528	msedge.exe	93
PID 3528 wrote to memory of 3296	3528	msedge.exe	93
PID 3528 wrote to memory of 2952	3528	msedge.exe	94
PID 3528 wrote to memory of 2952	3528	msedge.exe	94
PID 3528 wrote to memory of 2952	3528	msedge.exe	94
PID 3528 wrote to memory of 3752	3528	msedge.exe	95
PID 3528 wrote to memory of 3752	3528	msedge.exe	95
PID 3528 wrote to memory of 4420	3528	msedge.exe	99
PID 3528 wrote to memory of 4420	3528	msedge.exe	99
PID 3528 wrote to memory of 4936	3528	msedge.exe	101
PID 3528 wrote to memory of 3076	3528	msedge.exe	102
PID 3528 wrote to memory of 4936	3528	msedge.exe	101
PID 3528 wrote to memory of 3076	3528	msedge.exe	102
PID 5012 wrote to memory of 1628	5012	dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe	105
PID 3528 wrote to memory of 3792	3528	msedge.exe	108
PID 3528 wrote to memory of 3792	3528	msedge.exe	108
PID 3528 wrote to memory of 724	3528	msedge.exe	110
PID 3528 wrote to memory of 724	3528	msedge.exe	110
PID 3528 wrote to memory of 4856	3528	msedge.exe	111
PID 3528 wrote to memory of 2808	3528	msedge.exe	112
PID 3528 wrote to memory of 2808	3528	msedge.exe	112
PID 3528 wrote to memory of 1524	3528	msedge.exe	113
PID 3528 wrote to memory of 1524	3528	msedge.exe	113
PID 3528 wrote to memory of 5064	3528	msedge.exe	114
PID 3528 wrote to memory of 5064	3528	msedge.exe	114
PID 3528 wrote to memory of 2164	3528	msedge.exe	123
PID 3528 wrote to memory of 1628	3528	msedge.exe	124
PID 3528 wrote to memory of 4280	3528	msedge.exe	125
PID 3528 wrote to memory of 1972	3528	msedge.exe	127
PID 3528 wrote to memory of 1972	3528	msedge.exe	127
PID 3528 wrote to memory of 3468	3528	msedge.exe	129
PID 3528 wrote to memory of 3468	3528	msedge.exe	129
PID 3528 wrote to memory of 688	3528	msedge.exe	130
PID 3528 wrote to memory of 688	3528	msedge.exe	130
PID 3528 wrote to memory of 4360	3528	msedge.exe	131
PID 3528 wrote to memory of 4360	3528	msedge.exe	131
PID 3528 wrote to memory of 4900	3528	msedge.exe	132
PID 3528 wrote to memory of 3028	3528	msedge.exe	133
PID 3528 wrote to memory of 3028	3528	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe
"C:\Users\Admin\AppData\Local\Temp\dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977.bin.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks computer location settings
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --app="file:///C:/Users/Admin/AppData/Local/Temp/g1394.html" --window-size=1024,768
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff6636c188,0x7fff6636c194,0x7fff6636c1a0
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,924360551168098924,13410799721601169260,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,18349315280794432313,17527932750896298927,262144 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,2477189106798526585,12755362918622663372,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:8
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,8900984998358163346,5524344217146177234,2097152 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,5982346543624154351,4815520329873713559,2097152 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,46056956150136568,4154884426482657660,2097152 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,18063833241967941693,12932671016531544462,2097152 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1220699238859455363,12603556347059952878,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,320004648916564107,5420334486552776733,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,7696014038276518528,10656024201382155786,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,15027574844910058044,12241804817447018420,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16983970884114386964,5699052739502600584,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,17538977477836299429,291285627652409095,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,11134887562013775689,12371996611854707764,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
    3⤵
    PID:724
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,17538977477836299429,291285627652409095,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,2972028954832250941,152444908410507179,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,3619219901199875228,3766245930779187739,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,3252331652811373578,14254164512587291163,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,12215741488343477143,7293416636499425789,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,3718589133662619907,2284183771424535072,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,1908841517505701797,8594477300493176286,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,5680551597225973621,4556143739769594002,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,4671978193588839597,1858947440758649337,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,7910231512281407644,14678417564214761108,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
    3⤵
    PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,11781320716241377018,4315455258318928025,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5860,i,6876437635399116819,18288405424195546304,262144 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,17224934205641303430,12442084039970275373,524288 --field-trial-handle=2116,i,16396529698153449803,11115029149838859711,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
    3⤵
    PID:3028
- C:\Program Files\Google\Chrome\Application\__abeh_5012.exe
  "C:\Program Files\Google\Chrome\Application\__abeh_5012.exe" --abe-child AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAeYO/+TVtu0q36tifnM25mxAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAP4iIzSnOoRE20Wc4OSvJXb7F8aKzDWRkm8nIySNGA/LAAAAAA6AAAAAAgAAIAAAABu4Rwz/Mp3/3koMia8IjNLm5qwd4kaPi5+9uOGrGawskAEAAHpCfO8kdIWvdgNSjPHdr+X4Xows5SYqVMiTPg2dwePFLnX3fzCJfMAJwZ7nLZ4m4pHwOUDYaGMb0ydyWEdg8B08J9LQS/TEmqEmNc/q5YpEKt/E8jM2Wx2gZZPEFwGohVjr+ksQpBGwnk+bYzaX6EXDpVB87EkhwvcwmiWBskKpsw/PDyV7TCtzinlT9hkMf1hYK6KEOJBiPf7DpG6NVsgy/NCJTCW7jpY7ULYfW+Htb79R0XTeSVVom523xRX6IY5xpHhCuwhwEow0zvgZvdE6BF+w9rLYk4nWKjLl9l57tP05nBKFhPt6A2LyXpMgxrFDF2yaW5X/s+83GkTEoD3JYC7AfDcM8UvyUpipBB6HtNb0eIk2olLzZIQu1B/AwW5l2B2MOJmVHSeD5tZKql/nUl/clTfWxxM9l0m+arcEwbdJWV+Ck0SnaAMNL0y8Af4ZcNQJvYa7/9KRY1MMuEPBLbCYxTqIvNiXVGmYj7fgYRfeenV4Z405NSnHAep/+Ww8t8bmYKulErwnAKalic9AAAAAbYNm5m/OgJ+7kvsKkkY8NKHUVyzT4N+ksYJjH5kAI5x/snOkcn0LIYtRm/tzdUtz0+TC/jTXwPyM4FQO9pDniA== C:\Users\Admin\AppData\Local\Temp\__abek_5012.txt
  2⤵
  - Executes dropped EXE
  PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion