0bc34209adba693df004565db62ac2b8ac0a2fa249b89ca4f403479cd5bccbdf

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
09/04/2022, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Size 1.7MB
Sample220409-qexjdaehek
SHA256 0bc34209adba693df004565db62ac2b8ac0a2fa249b89ca4f403479cd5bccbdf
MD5 b494a2dfaf44b4b876877ad2b2dcd0d1
SHA1 767c00e5ec97aff867b5cd8d51a7bb0f7c5ff4f0
SHA512 50a16b2e47fc687bdfa2ae1c8d7980499181b1f22800c03fa60dda76b3c9cfbe6e145fe2d32c4b08fe158c37b532f474ecbdfe332eae69d955dd37f6711f1b36
MD5 SHA1 SHA512

Score

10^/10

discovery evasion persistence spyware stealer suricata trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 19 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Documents and Settings\\StartMenuExperienceHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Documents and Settings\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Mail\\Registry.exe\", \"C:\\ProgramData\\Packages\\backgroundTaskHost.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Public\\Videos\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Documents and Settings\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Mail\\Registry.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Documents and Settings\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Mail\\Registry.exe\", \"C:\\ProgramData\\Packages\\backgroundTaskHost.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\dllhost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Documents and Settings\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Mail\\Registry.exe\", \"C:\\ProgramData\\Packages\\backgroundTaskHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Documents and Settings\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Mail\\Registry.exe\", \"C:\\ProgramData\\Packages\\backgroundTaskHost.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Documents and Settings\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Mail\\Registry.exe\", \"C:\\ProgramData\\Packages\\backgroundTaskHost.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Public\\Videos\\upfc.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Documents and Settings\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Mail\\Registry.exe\", \"C:\\ProgramData\\Packages\\backgroundTaskHost.exe\", \"C:\\ProgramData\\USOShared\\Logs\\User\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Public\\Videos\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\ProgramData\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\smss.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\backgroundTaskHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	64	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3240	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	500	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	500	schtasks.exe	27

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

Executes dropped EXE 1 IoCs

pid	Process
2188	csrss.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation	csrss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Documents and Settings\\fontdrvhost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Documents and Settings\\StartMenuExperienceHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\StartMenuExperienceHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\ProgramData\\Packages\\Microsoft.549981C3F5F10_8wekyb3d8bbwe\\smss.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\odt\\fontdrvhost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\odt\\StartMenuExperienceHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Windows NT\\Accessories\\en-US\\winlogon.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Google\\Update\\Download\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\89.0.4389.114\\Registry.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files\\Windows Mail\\Registry.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\ProgramData\\Packages\\backgroundTaskHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\ProgramData\\USOShared\\Logs\\User\\dllhost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Users\\Public\\Videos\\upfc.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Users\\Default\\backgroundTaskHost.exe\""	b494a2dfaf44b4b876877ad2b2dcd0d1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\RCX7AAB.tmp	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCX86C9.tmp	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\RCX89C9.tmp	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files\Windows Mail\RCX9645.tmp	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCX748D.tmp	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File created	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\Registry.exe	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File created	C:\Program Files\Windows Mail\ee2ad38f3d4382	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\cc11b995f2a76d	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\55b276f4edf653	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCX750B.tmp	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\RCX7B29.tmp	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCX8747.tmp	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files\Windows Mail\Registry.exe	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\9e8d7a4ca61bd9	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File created	C:\Program Files\Windows Mail\Registry.exe	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\RCX8A47.tmp	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\Registry.exe	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File opened for modification	C:\Program Files\Windows Mail\RCX95C7.tmp	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
File created	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\ee2ad38f3d4382	b494a2dfaf44b4b876877ad2b2dcd0d1.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\LanguageOverlayCache\csrss.exe	b494a2dfaf44b4b876877ad2b2dcd0d1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3568	schtasks.exe
1956	schtasks.exe
1808	schtasks.exe
4480	schtasks.exe
4716	schtasks.exe
3392	schtasks.exe
4080	schtasks.exe
3948	schtasks.exe
3320	schtasks.exe
3368	schtasks.exe
1668	schtasks.exe
3140	schtasks.exe
4020	schtasks.exe
3628	schtasks.exe
3876	schtasks.exe
60	schtasks.exe
912	schtasks.exe
4932	schtasks.exe
4308	schtasks.exe
208	schtasks.exe
2012	schtasks.exe
2196	schtasks.exe
1552	schtasks.exe
820	schtasks.exe
3276	schtasks.exe
2888	schtasks.exe
1312	schtasks.exe
4444	schtasks.exe
1860	schtasks.exe
3388	schtasks.exe
1344	schtasks.exe
1308	schtasks.exe
1612	schtasks.exe
3180	schtasks.exe
3240	schtasks.exe
4196	schtasks.exe
2956	schtasks.exe
2840	schtasks.exe
64	schtasks.exe
2520	schtasks.exe
3128	schtasks.exe
3456	schtasks.exe
4756	schtasks.exe
4056	schtasks.exe
2844	schtasks.exe
928	schtasks.exe
1720	schtasks.exe
4380	schtasks.exe
4448	schtasks.exe
5004	schtasks.exe
4892	schtasks.exe
3296	schtasks.exe
4556	schtasks.exe
4860	schtasks.exe
3668	schtasks.exe
1276	schtasks.exe
2556	schtasks.exe
4032	schtasks.exe
1224	schtasks.exe
628	schtasks.exe
3988	schtasks.exe
1812	schtasks.exe
3944	schtasks.exe
1356	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	b494a2dfaf44b4b876877ad2b2dcd0d1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2188	csrss.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2188	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 2696	4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe	163
PID 4840 wrote to memory of 2696	4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe	163
PID 4840 wrote to memory of 2188	4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe	165
PID 4840 wrote to memory of 2188	4840	b494a2dfaf44b4b876877ad2b2dcd0d1.exe	165
PID 2188 wrote to memory of 1084	2188	csrss.exe	167
PID 2188 wrote to memory of 1084	2188	csrss.exe	167
PID 2188 wrote to memory of 3812	2188	csrss.exe	168
PID 2188 wrote to memory of 3812	2188	csrss.exe	168

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b494a2dfaf44b4b876877ad2b2dcd0d1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

C:\Users\Admin\AppData\Local\Temp\b494a2dfaf44b4b876877ad2b2dcd0d1.exe
"C:\Users\Admin\AppData\Local\Temp\b494a2dfaf44b4b876877ad2b2dcd0d1.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\odt\csrss.exe
  "C:\odt\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2188
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93faeb8a-d8e7-4d54-8bd0-5191daa7dc69.vbs"
    3⤵
    PID:1084
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c168a674-29f8-4875-8ce2-4ab467a790ed.vbs"
    3⤵
    PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WyabbackgroundTaskHost" /sc MINUTE /mo 10 /tr "'C:\Users\Default\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "nSzVbackgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "t6ElbackgroundTaskHost" /sc ONSTART /tr "'C:\Users\Default\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc MINUTE /mo 12 /tr "'C:\Users\Default\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2AtoRuntimeBroker" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mdDkRuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "aofERuntimeBroker" /sc ONSTART /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "QjBVcsrss" /sc MINUTE /mo 10 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OnJOcsrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "vIxUcsrss" /sc ONSTART /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 11 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "eXwiwinlogon" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mJoqwinlogon" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lrddwinlogon" /sc ONSTART /tr "'C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "zOirStartMenuExperienceHost" /sc MINUTE /mo 14 /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "eGkTStartMenuExperienceHost" /sc ONLOGON /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Wi9JStartMenuExperienceHost" /sc ONSTART /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc MINUTE /mo 10 /tr "'C:\odt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "M2rBfontdrvhost" /sc MINUTE /mo 9 /tr "'C:\Documents and Settings\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Ky6Efontdrvhost" /sc ONLOGON /tr "'C:\Documents and Settings\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "V7gxfontdrvhost" /sc ONSTART /tr "'C:\Documents and Settings\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc MINUTE /mo 9 /tr "'C:\Documents and Settings\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "A7Jrfontdrvhost" /sc MINUTE /mo 10 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LfoKfontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Iq8Ufontdrvhost" /sc ONSTART /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc MINUTE /mo 9 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "KQEXStartMenuExperienceHost" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3KmxStartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "jdh3StartMenuExperienceHost" /sc ONSTART /tr "'C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ZpC0Registry" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hgvKRegistry" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3hX0Registry" /sc ONSTART /tr "'C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "E2e2RuntimeBroker" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XN0BRuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "p0LZRuntimeBroker" /sc ONSTART /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9jThRegistry" /sc MINUTE /mo 13 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4S6nRegistry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XDeCRegistry" /sc ONSTART /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc MINUTE /mo 5 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dXUyStartMenuExperienceHost" /sc MINUTE /mo 6 /tr "'C:\Documents and Settings\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "yIuIStartMenuExperienceHost" /sc ONLOGON /tr "'C:\Documents and Settings\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrpdStartMenuExperienceHost" /sc ONSTART /tr "'C:\Documents and Settings\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc MINUTE /mo 8 /tr "'C:\Documents and Settings\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "pyWIRegistry" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "77ZHRegistry" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "KOFXRegistry" /sc ONSTART /tr "'C:\Program Files\Windows Mail\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HQ05backgroundTaskHost" /sc MINUTE /mo 9 /tr "'C:\ProgramData\Packages\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hqT4backgroundTaskHost" /sc ONLOGON /tr "'C:\ProgramData\Packages\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wZvcbackgroundTaskHost" /sc ONSTART /tr "'C:\ProgramData\Packages\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc MINUTE /mo 8 /tr "'C:\ProgramData\Packages\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "uzbDdllhost" /sc MINUTE /mo 14 /tr "'C:\ProgramData\USOShared\Logs\User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "CTAFdllhost" /sc ONLOGON /tr "'C:\ProgramData\USOShared\Logs\User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "8kuMdllhost" /sc ONSTART /tr "'C:\ProgramData\USOShared\Logs\User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc MINUTE /mo 12 /tr "'C:\ProgramData\USOShared\Logs\User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "v57bStartMenuExperienceHost" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "VZ47StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2M9BStartMenuExperienceHost" /sc ONSTART /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9itFupfc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Videos\upfc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ifokupfc" /sc ONLOGON /tr "'C:\Users\Public\Videos\upfc.exe'" /rl HIGHEST /f
1⤵
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "VSadupfc" /sc ONSTART /tr "'C:\Users\Public\Videos\upfc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\upfc.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "oULFRuntimeBroker" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "g1vSRuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cH3cRuntimeBroker" /sc ONSTART /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "We30smss" /sc MINUTE /mo 8 /tr "'C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\smss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Sfs1smss" /sc ONLOGON /tr "'C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\smss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TfV0smss" /sc ONSTART /tr "'C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\smss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc MINUTE /mo 14 /tr "'C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\smss.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

93faeb8a-d8e7-4d54-8bd0-5191daa7dc69.vbs

Path C:\Users\Admin\AppData\Local\Temp\93faeb8a-d8e7-4d54-8bd0-5191daa7dc69.vbs
Size 692B
SHA256 7dffd8f4e7f6295f851a549e158cee0fa3bf18783aa122989992ae53338ede21
MD5 15e2c49525f98e39880c958589e20c55
SHA1 502519e6561ffb31d00043f4577c29c584b2d9c2
SHA512 b15a90fed3bee8890b8955abf32626c3e60e211a02b105bfb30cad7dd19f659905af04d56b351944de1ac332c471919d5596635ac3b15ca790b0dd10d5a3c454
MD5 SHA1 SHA512

Submit Download

c168a674-29f8-4875-8ce2-4ab467a790ed.vbs

Path C:\Users\Admin\AppData\Local\Temp\c168a674-29f8-4875-8ce2-4ab467a790ed.vbs
Size 468B
SHA256 d913f90dd35cee88039c43dcc64691a94e8f4ab1331e38a6e9eacf13e35cfbc4
MD5 e267e7c96c5721f90ffb686778c87e75
SHA1 fc384bd933fc49b95c765caf8ced973b7f949ddb
SHA512 34dd54421e89c9893105ff6c1114dc15648719c1bba87bfd96f0de2a38fdc972597680cbf5e476ec1258c5ce203a6ec2799d4957131d71bd64c88d5c40a56d03
MD5 SHA1 SHA512

Submit Download

csrss.exe

Path C:\odt\csrss.exe
Size 1.7MB
SHA256 94d1cf780039c4436636a28488a631caf850253965e2e0ede210411917ebc7a9
MD5 b62049af93b9e918060ac95a14000838
SHA1 b6086e153d5d07b2f2466253c4b6455443461eaf
SHA512 9bad3231852408d928e8a037a02f7423801701f9b0c333c2659ad610fc6d83c5c48ea0520b17160b175400d085fb45172832464197df17ed03aabec17b63c142
SSDEEP 24576:oiaZ6o2Cj6AEe1YeMSzTStc8oAMHSnvR7htpq6K8fv1eNkJMhsS8xxgQ2gzycZjX:fqziPfPrA83mhsS8xCQ2gzy8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\odt\csrss.exe
Size 1.7MB
SHA256 94d1cf780039c4436636a28488a631caf850253965e2e0ede210411917ebc7a9
MD5 b62049af93b9e918060ac95a14000838
SHA1 b6086e153d5d07b2f2466253c4b6455443461eaf
SHA512 9bad3231852408d928e8a037a02f7423801701f9b0c333c2659ad610fc6d83c5c48ea0520b17160b175400d085fb45172832464197df17ed03aabec17b63c142
SSDEEP 24576:oiaZ6o2Cj6AEe1YeMSzTStc8oAMHSnvR7htpq6K8fv1eNkJMhsS8xxgQ2gzycZjX:fqziPfPrA83mhsS8xCQ2gzy8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2188-141-0x00007FFFE5440000-0x00007FFFE5F01000-memory.dmp

Download

memory/2188-139-0x0000000000F80000-0x0000000001130000-memory.dmp

Download

memory/2696-140-0x00007FFFE5440000-0x00007FFFE5F01000-memory.dmp

Download

memory/2696-135-0x0000019DAC780000-0x0000019DAC7A2000-memory.dmp

Download

memory/4840-129-0x000000001B905000-0x000000001B907000-memory.dmp

Download

memory/4840-131-0x000000001B909000-0x000000001B90F000-memory.dmp

Download

memory/4840-130-0x000000001B907000-0x000000001B909000-memory.dmp

Download

memory/4840-133-0x000000001CC84000-0x000000001CC95000-memory.dmp

Download

memory/4840-132-0x000000001CC80000-0x000000001CC84000-memory.dmp

Download

memory/4840-128-0x000000001B903000-0x000000001B905000-memory.dmp

Download

memory/4840-127-0x000000001BF60000-0x000000001BFB0000-memory.dmp

Download

memory/4840-124-0x0000000000B50000-0x0000000000D00000-memory.dmp

Download

memory/4840-126-0x000000001B900000-0x000000001B902000-memory.dmp

Download

memory/4840-125-0x00007FFFE5440000-0x00007FFFE5F01000-memory.dmp

Download