dcrat | 3112d4e0121280fb873e65e7077ca465e38566e6ebedd9389f3186cd801992a4

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\7-Zip\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\ffc00a26ff38e37b47b2c75f92b48929\\conhost.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\Java\\jre1.8.0_66\\lib\\cmm\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\powershell.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Windows\\tracing\\powershell.exe\", \"C:\\Users\\Public\\Libraries\\OfficeClickToRun.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\7-Zip\\fontdrvhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\7-Zip\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\ffc00a26ff38e37b47b2c75f92b48929\\conhost.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\7-Zip\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\ffc00a26ff38e37b47b2c75f92b48929\\conhost.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\Java\\jre1.8.0_66\\lib\\cmm\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\powershell.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\7-Zip\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\7-Zip\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\ffc00a26ff38e37b47b2c75f92b48929\\conhost.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\Java\\jre1.8.0_66\\lib\\cmm\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\powershell.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\7-Zip\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\ffc00a26ff38e37b47b2c75f92b48929\\conhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\7-Zip\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\ffc00a26ff38e37b47b2c75f92b48929\\conhost.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\Java\\jre1.8.0_66\\lib\\cmm\\dllhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\7-Zip\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\ffc00a26ff38e37b47b2c75f92b48929\\conhost.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\Java\\jre1.8.0_66\\lib\\cmm\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\powershell.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\7-Zip\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\ffc00a26ff38e37b47b2c75f92b48929\\conhost.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\Java\\jre1.8.0_66\\lib\\cmm\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\powershell.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\odt\\conhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\PLA\\System\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\7-Zip\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\ffc00a26ff38e37b47b2c75f92b48929\\conhost.exe\", \"C:\\Program Files\\Windows Portable Devices\\powershell.exe\", \"C:\\Program Files\\Java\\jre1.8.0_66\\lib\\cmm\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\powershell.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\odt\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Windows\\tracing\\powershell.exe\""	b2ed94774d28f6a99e563f15777cc015.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	480	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3240	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	4624	schtasks.exe	53
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	4624	schtasks.exe	53

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	powershell.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4364-132-0x0000000000EE0000-0x000000000123E000-memory.dmp	dcrat
behavioral2/files/0x0007000000022e0a-152.dat	dcrat
behavioral2/files/0x0006000000022e1e-206.dat	dcrat
behavioral2/files/0x0006000000022e1e-205.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
680	b2ed94774d28f6a99e563f15777cc015.exe
1980	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	b2ed94774d28f6a99e563f15777cc015.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	b2ed94774d28f6a99e563f15777cc015.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	powershell.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\odt\\fontdrvhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Program Files\\Windows Portable Devices\\powershell.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Windows\\tracing\\powershell.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\7-Zip\\fontdrvhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Recovery\\WindowsRE\\powershell.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Public\\Libraries\\OfficeClickToRun.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\ffc00a26ff38e37b47b2c75f92b48929\\conhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\odt\\conhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Windows\\tracing\\powershell.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\PLA\\System\\dllhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\odt\\fontdrvhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Program Files\\Windows Portable Devices\\powershell.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Java\\jre1.8.0_66\\lib\\cmm\\dllhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\Recovery\\WindowsRE\\powershell.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\odt\\conhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\7-Zip\\fontdrvhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Java\\jre1.8.0_66\\lib\\cmm\\dllhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Public\\Libraries\\OfficeClickToRun.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\PLA\\System\\dllhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Defender\\de-DE\\RuntimeBroker.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\ffc00a26ff38e37b47b2c75f92b48929\\conhost.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b2ed94774d28f6a99e563f15777cc015.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	ipinfo.io
38	ipinfo.io

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\spoolsv.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\7-Zip\5b884080fd4f94	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\9e8d7a4ca61bd9	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files\7-Zip\fontdrvhost.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\0f6cb653-88a5-4c1c-8e15-a6c874946afb.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220825025707.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RCX90CD.tmp	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\spoolsv.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\Windows Portable Devices\e978f868350d50	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\cmm\dllhost.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\f3b6ecef712a24	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\cmm\5940a34987c991	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\Windows Portable Devices\powershell.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\7-Zip\fontdrvhost.exe	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files\Windows Portable Devices\powershell.exe	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files\Windows Portable Devices\e978f868350d50	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\cmm\dllhost.exe	b2ed94774d28f6a99e563f15777cc015.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tracing\powershell.exe	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Windows\PLA\System\dllhost.exe	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Windows\PLA\System\RCX8E3C.tmp	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\conhost.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\conhost.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\088424020bedd6	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Windows\tracing\powershell.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Windows\tracing\e978f868350d50	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Windows\OCR\en-us\SppExtComObj.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Windows\PLA\System\dllhost.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Windows\PLA\System\5940a34987c991	b2ed94774d28f6a99e563f15777cc015.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3140	schtasks.exe
1604	schtasks.exe
4256	schtasks.exe
3172	schtasks.exe
2156	schtasks.exe
4464	schtasks.exe
4512	schtasks.exe
3952	schtasks.exe
2156	schtasks.exe
2236	schtasks.exe
4764	schtasks.exe
4408	schtasks.exe
1328	schtasks.exe
1820	schtasks.exe
2076	schtasks.exe
3640	schtasks.exe
1880	schtasks.exe
3248	schtasks.exe
3068	schtasks.exe
4868	schtasks.exe
1140	schtasks.exe
4864	schtasks.exe
1052	schtasks.exe
2660	schtasks.exe
4932	schtasks.exe
860	schtasks.exe
4008	schtasks.exe
2920	schtasks.exe
5056	schtasks.exe
4924	schtasks.exe
480	schtasks.exe
5044	schtasks.exe
4108	schtasks.exe
208	schtasks.exe
3440	schtasks.exe
3240	schtasks.exe
1052	schtasks.exe
512	schtasks.exe
2860	schtasks.exe
332	schtasks.exe
4928	schtasks.exe
1636	schtasks.exe
4276	schtasks.exe
436	schtasks.exe
4196	schtasks.exe
1104	schtasks.exe
3016	schtasks.exe
4452	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "169"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4264	powershell.exe
4264	powershell.exe
3552	powershell.exe
3552	powershell.exe
744	powershell.exe
744	powershell.exe
1648	powershell.exe
1648	powershell.exe
2224	powershell.exe
2224	powershell.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
4364	b2ed94774d28f6a99e563f15777cc015.exe
3908	powershell.exe
3908	powershell.exe
4012	powershell.exe
4012	powershell.exe
1184	powershell.exe
1184	powershell.exe
2208	powershell.exe
2208	powershell.exe
4484	msedge.exe
4484	msedge.exe
912	powershell.exe
912	powershell.exe
3776	powershell.exe
3776	powershell.exe
4264	powershell.exe
4264	powershell.exe
3552	powershell.exe
744	powershell.exe
1648	powershell.exe
2224	powershell.exe
4012	powershell.exe
3908	powershell.exe
1184	powershell.exe
2208	powershell.exe
4484	msedge.exe
3776	powershell.exe
912	powershell.exe
680	b2ed94774d28f6a99e563f15777cc015.exe
680	b2ed94774d28f6a99e563f15777cc015.exe
680	b2ed94774d28f6a99e563f15777cc015.exe
680	b2ed94774d28f6a99e563f15777cc015.exe
680	b2ed94774d28f6a99e563f15777cc015.exe
680	b2ed94774d28f6a99e563f15777cc015.exe
680	b2ed94774d28f6a99e563f15777cc015.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	4364	b2ed94774d28f6a99e563f15777cc015.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	1184	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	4484	msedge.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeDebugPrivilege	680	b2ed94774d28f6a99e563f15777cc015.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeBackupPrivilege	2060	vssvc.exe
Token: SeRestorePrivilege	2060	vssvc.exe
Token: SeAuditPrivilege	2060	vssvc.exe
Token: SeShutdownPrivilege	6036	shutdown.exe
Token: SeRemoteShutdownPrivilege	6036	shutdown.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1980	powershell.exe
6100	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3552	4364	b2ed94774d28f6a99e563f15777cc015.exe	89
PID 4364 wrote to memory of 3552	4364	b2ed94774d28f6a99e563f15777cc015.exe	89
PID 4364 wrote to memory of 4264	4364	b2ed94774d28f6a99e563f15777cc015.exe	91
PID 4364 wrote to memory of 4264	4364	b2ed94774d28f6a99e563f15777cc015.exe	91
PID 4364 wrote to memory of 1648	4364	b2ed94774d28f6a99e563f15777cc015.exe	113
PID 4364 wrote to memory of 1648	4364	b2ed94774d28f6a99e563f15777cc015.exe	113
PID 4364 wrote to memory of 2224	4364	b2ed94774d28f6a99e563f15777cc015.exe	93
PID 4364 wrote to memory of 2224	4364	b2ed94774d28f6a99e563f15777cc015.exe	93
PID 4364 wrote to memory of 3908	4364	b2ed94774d28f6a99e563f15777cc015.exe	94
PID 4364 wrote to memory of 3908	4364	b2ed94774d28f6a99e563f15777cc015.exe	94
PID 4364 wrote to memory of 744	4364	b2ed94774d28f6a99e563f15777cc015.exe	95
PID 4364 wrote to memory of 744	4364	b2ed94774d28f6a99e563f15777cc015.exe	95
PID 4364 wrote to memory of 4012	4364	b2ed94774d28f6a99e563f15777cc015.exe	109
PID 4364 wrote to memory of 4012	4364	b2ed94774d28f6a99e563f15777cc015.exe	109
PID 4364 wrote to memory of 1184	4364	b2ed94774d28f6a99e563f15777cc015.exe	107
PID 4364 wrote to memory of 1184	4364	b2ed94774d28f6a99e563f15777cc015.exe	107
PID 4364 wrote to memory of 2208	4364	b2ed94774d28f6a99e563f15777cc015.exe	98
PID 4364 wrote to memory of 2208	4364	b2ed94774d28f6a99e563f15777cc015.exe	98
PID 4364 wrote to memory of 4484	4364	b2ed94774d28f6a99e563f15777cc015.exe	99
PID 4364 wrote to memory of 4484	4364	b2ed94774d28f6a99e563f15777cc015.exe	99
PID 4364 wrote to memory of 3776	4364	b2ed94774d28f6a99e563f15777cc015.exe	105
PID 4364 wrote to memory of 3776	4364	b2ed94774d28f6a99e563f15777cc015.exe	105
PID 4364 wrote to memory of 912	4364	b2ed94774d28f6a99e563f15777cc015.exe	104
PID 4364 wrote to memory of 912	4364	b2ed94774d28f6a99e563f15777cc015.exe	104
PID 4364 wrote to memory of 680	4364	b2ed94774d28f6a99e563f15777cc015.exe	112
PID 4364 wrote to memory of 680	4364	b2ed94774d28f6a99e563f15777cc015.exe	112
PID 680 wrote to memory of 1036	680	b2ed94774d28f6a99e563f15777cc015.exe	180
PID 680 wrote to memory of 1036	680	b2ed94774d28f6a99e563f15777cc015.exe	180
PID 680 wrote to memory of 796	680	b2ed94774d28f6a99e563f15777cc015.exe	179
PID 680 wrote to memory of 796	680	b2ed94774d28f6a99e563f15777cc015.exe	179
PID 680 wrote to memory of 4996	680	b2ed94774d28f6a99e563f15777cc015.exe	178
PID 680 wrote to memory of 4996	680	b2ed94774d28f6a99e563f15777cc015.exe	178
PID 680 wrote to memory of 4368	680	b2ed94774d28f6a99e563f15777cc015.exe	176
PID 680 wrote to memory of 4368	680	b2ed94774d28f6a99e563f15777cc015.exe	176
PID 680 wrote to memory of 4144	680	b2ed94774d28f6a99e563f15777cc015.exe	174
PID 680 wrote to memory of 4144	680	b2ed94774d28f6a99e563f15777cc015.exe	174
PID 680 wrote to memory of 2360	680	b2ed94774d28f6a99e563f15777cc015.exe	173
PID 680 wrote to memory of 2360	680	b2ed94774d28f6a99e563f15777cc015.exe	173
PID 680 wrote to memory of 1852	680	b2ed94774d28f6a99e563f15777cc015.exe	158
PID 680 wrote to memory of 1852	680	b2ed94774d28f6a99e563f15777cc015.exe	158
PID 680 wrote to memory of 4696	680	b2ed94774d28f6a99e563f15777cc015.exe	159
PID 680 wrote to memory of 4696	680	b2ed94774d28f6a99e563f15777cc015.exe	159
PID 680 wrote to memory of 4116	680	b2ed94774d28f6a99e563f15777cc015.exe	160
PID 680 wrote to memory of 4116	680	b2ed94774d28f6a99e563f15777cc015.exe	160
PID 680 wrote to memory of 4264	680	b2ed94774d28f6a99e563f15777cc015.exe	161
PID 680 wrote to memory of 4264	680	b2ed94774d28f6a99e563f15777cc015.exe	161
PID 680 wrote to memory of 2120	680	b2ed94774d28f6a99e563f15777cc015.exe	162
PID 680 wrote to memory of 2120	680	b2ed94774d28f6a99e563f15777cc015.exe	162
PID 680 wrote to memory of 1332	680	b2ed94774d28f6a99e563f15777cc015.exe	165
PID 680 wrote to memory of 1332	680	b2ed94774d28f6a99e563f15777cc015.exe	165
PID 680 wrote to memory of 1980	680	b2ed94774d28f6a99e563f15777cc015.exe	167
PID 680 wrote to memory of 1980	680	b2ed94774d28f6a99e563f15777cc015.exe	167
PID 1980 wrote to memory of 3496	1980	powershell.exe	186
PID 1980 wrote to memory of 3496	1980	powershell.exe	186
PID 1980 wrote to memory of 3084	1980	powershell.exe	185
PID 1980 wrote to memory of 3084	1980	powershell.exe	185
PID 1980 wrote to memory of 1316	1980	powershell.exe	194
PID 1980 wrote to memory of 1316	1980	powershell.exe	194
PID 1316 wrote to memory of 1220	1316	msedge.exe	195
PID 1316 wrote to memory of 1220	1316	msedge.exe	195
PID 1316 wrote to memory of 4244	1316	msedge.exe	196
PID 1316 wrote to memory of 4244	1316	msedge.exe	196
PID 1316 wrote to memory of 4244	1316	msedge.exe	196
PID 1316 wrote to memory of 4244	1316	msedge.exe	196

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b2ed94774d28f6a99e563f15777cc015.exe

C:\Users\Admin\AppData\Local\Temp\b2ed94774d28f6a99e563f15777cc015.exe
"C:\Users\Admin\AppData\Local\Temp\b2ed94774d28f6a99e563f15777cc015.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  PID:4264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  PID:4484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Users\Admin\AppData\Local\Temp\b2ed94774d28f6a99e563f15777cc015.exe
  "C:\Users\Admin\AppData\Local\Temp\b2ed94774d28f6a99e563f15777cc015.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- - C:\Program Files\Windows Portable Devices\powershell.exe
    "C:\Program Files\Windows Portable Devices\powershell.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1980
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\245dbe3b-d335-499f-a936-bd962bbf6f1a.vbs"
      4⤵
      PID:3084
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ec86e92-9e25-4398-9f1a-7d1d82fa695d.vbs"
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:12389/
      4⤵
      Adds Run key to start application
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ff82acd46f8,0x7ff82acd4708,0x7ff82acd4718
        5⤵
        
        PID:1220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        5⤵
        
        PID:4244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
        5⤵
        
        PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3120 /prefetch:8
        5⤵
        
        PID:3172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
        5⤵
        
        PID:1696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
        5⤵
        
        PID:3480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5500 /prefetch:8
        5⤵
        
        PID:292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
        5⤵
        
        PID:268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5572 /prefetch:8
        5⤵
        
        PID:5028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
        5⤵
        
        PID:5216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4232 /prefetch:8
        5⤵
        
        PID:5300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        
        PID:5308
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1e8,0x22c,0x7ff7bfb65460,0x7ff7bfb65470,0x7ff7bfb65480
        6⤵
        
        PID:5368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4232 /prefetch:8
        5⤵
        
        PID:5568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
        5⤵
        
        PID:5588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6263815271905253858,17152326052926581138,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
        5⤵
        
        PID:5944
  - - C:\Windows\System32\shutdown.exe
      "C:\Windows\System32\shutdown.exe" /s /t 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\PLA\System\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\PLA\System\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\PLA\System\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jre1.8.0_66\lib\cmm\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jre1.8.0_66\lib\cmm\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Windows\tracing\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\tracing\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Windows\tracing\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Public\Libraries\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Libraries\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Java\jre1.8.0_66\lib\cmm\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1824

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3936055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery