dcrat | 0013a9fa302baf10fc02be4c127319303b9f6ac410231cd1eabf7295be6b65d4

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	0013a9fa302baf10fc02be4c127319303b9f6ac410231cd1eabf7295be6b65d4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{82FD83BB-A563-4486-8D36-617E39B1818B}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{054639C6-BE27-45CC-934E-B95EA487DB56}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2288	schtasks.exe
2444	schtasks.exe
1584	schtasks.exe
1872	schtasks.exe
1884	schtasks.exe
2916	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	0013a9fa302baf10fc02be4c127319303b9f6ac410231cd1eabf7295be6b65d4.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	backgroundTaskHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1820	DllCommonsvc.exe
3496	powershell.exe
3640	powershell.exe
2960	powershell.exe
2960	powershell.exe
3496	powershell.exe
3640	powershell.exe
4472	backgroundTaskHost.exe
1724	backgroundTaskHost.exe
3728	backgroundTaskHost.exe
1356	backgroundTaskHost.exe
4488	backgroundTaskHost.exe
1360	backgroundTaskHost.exe
4212	backgroundTaskHost.exe
3936	backgroundTaskHost.exe
924	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	DllCommonsvc.exe
Token: SeDebugPrivilege	3640	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	4472	backgroundTaskHost.exe
Token: SeDebugPrivilege	1724	backgroundTaskHost.exe
Token: SeDebugPrivilege	3728	backgroundTaskHost.exe
Token: SeDebugPrivilege	1356	backgroundTaskHost.exe
Token: SeDebugPrivilege	4488	backgroundTaskHost.exe
Token: SeDebugPrivilege	1360	backgroundTaskHost.exe
Token: SeDebugPrivilege	4212	backgroundTaskHost.exe
Token: SeDebugPrivilege	3936	backgroundTaskHost.exe
Token: SeDebugPrivilege	924	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 748	1544	0013a9fa302baf10fc02be4c127319303b9f6ac410231cd1eabf7295be6b65d4.exe	86
PID 1544 wrote to memory of 748	1544	0013a9fa302baf10fc02be4c127319303b9f6ac410231cd1eabf7295be6b65d4.exe	86
PID 1544 wrote to memory of 748	1544	0013a9fa302baf10fc02be4c127319303b9f6ac410231cd1eabf7295be6b65d4.exe	86
PID 748 wrote to memory of 3024	748	WScript.exe	89
PID 748 wrote to memory of 3024	748	WScript.exe	89
PID 748 wrote to memory of 3024	748	WScript.exe	89
PID 3024 wrote to memory of 1820	3024	cmd.exe	91
PID 3024 wrote to memory of 1820	3024	cmd.exe	91
PID 1820 wrote to memory of 3496	1820	DllCommonsvc.exe	98
PID 1820 wrote to memory of 3496	1820	DllCommonsvc.exe	98
PID 1820 wrote to memory of 3640	1820	DllCommonsvc.exe	99
PID 1820 wrote to memory of 3640	1820	DllCommonsvc.exe	99
PID 1820 wrote to memory of 2960	1820	DllCommonsvc.exe	102
PID 1820 wrote to memory of 2960	1820	DllCommonsvc.exe	102
PID 1820 wrote to memory of 4472	1820	DllCommonsvc.exe	104
PID 1820 wrote to memory of 4472	1820	DllCommonsvc.exe	104
PID 4472 wrote to memory of 3804	4472	backgroundTaskHost.exe	106
PID 4472 wrote to memory of 3804	4472	backgroundTaskHost.exe	106
PID 3804 wrote to memory of 2720	3804	cmd.exe	108
PID 3804 wrote to memory of 2720	3804	cmd.exe	108
PID 3804 wrote to memory of 1724	3804	cmd.exe	111
PID 3804 wrote to memory of 1724	3804	cmd.exe	111
PID 1724 wrote to memory of 4004	1724	backgroundTaskHost.exe	112
PID 1724 wrote to memory of 4004	1724	backgroundTaskHost.exe	112
PID 4004 wrote to memory of 2948	4004	cmd.exe	114
PID 4004 wrote to memory of 2948	4004	cmd.exe	114
PID 4004 wrote to memory of 3728	4004	cmd.exe	115
PID 4004 wrote to memory of 3728	4004	cmd.exe	115
PID 3728 wrote to memory of 2488	3728	backgroundTaskHost.exe	116
PID 3728 wrote to memory of 2488	3728	backgroundTaskHost.exe	116
PID 2488 wrote to memory of 1084	2488	cmd.exe	118
PID 2488 wrote to memory of 1084	2488	cmd.exe	118
PID 2488 wrote to memory of 1356	2488	cmd.exe	122
PID 2488 wrote to memory of 1356	2488	cmd.exe	122
PID 1356 wrote to memory of 1120	1356	backgroundTaskHost.exe	123
PID 1356 wrote to memory of 1120	1356	backgroundTaskHost.exe	123
PID 1120 wrote to memory of 388	1120	cmd.exe	125
PID 1120 wrote to memory of 388	1120	cmd.exe	125
PID 1120 wrote to memory of 4488	1120	cmd.exe	126
PID 1120 wrote to memory of 4488	1120	cmd.exe	126
PID 4488 wrote to memory of 3040	4488	backgroundTaskHost.exe	127
PID 4488 wrote to memory of 3040	4488	backgroundTaskHost.exe	127
PID 3040 wrote to memory of 2856	3040	cmd.exe	129
PID 3040 wrote to memory of 2856	3040	cmd.exe	129
PID 3040 wrote to memory of 1360	3040	cmd.exe	130
PID 3040 wrote to memory of 1360	3040	cmd.exe	130
PID 1360 wrote to memory of 1084	1360	backgroundTaskHost.exe	137
PID 1360 wrote to memory of 1084	1360	backgroundTaskHost.exe	137
PID 1084 wrote to memory of 1580	1084	cmd.exe	139
PID 1084 wrote to memory of 1580	1084	cmd.exe	139
PID 1084 wrote to memory of 4212	1084	cmd.exe	141
PID 1084 wrote to memory of 4212	1084	cmd.exe	141
PID 4212 wrote to memory of 1396	4212	backgroundTaskHost.exe	142
PID 4212 wrote to memory of 1396	4212	backgroundTaskHost.exe	142
PID 1396 wrote to memory of 2792	1396	cmd.exe	144
PID 1396 wrote to memory of 2792	1396	cmd.exe	144
PID 1396 wrote to memory of 3936	1396	cmd.exe	145
PID 1396 wrote to memory of 3936	1396	cmd.exe	145
PID 3936 wrote to memory of 3616	3936	backgroundTaskHost.exe	146
PID 3936 wrote to memory of 3616	3936	backgroundTaskHost.exe	146
PID 3616 wrote to memory of 4548	3616	cmd.exe	148
PID 3616 wrote to memory of 4548	3616	cmd.exe	148
PID 3616 wrote to memory of 924	3616	cmd.exe	149
PID 3616 wrote to memory of 924	3616	cmd.exe	149

C:\Users\Admin\AppData\Local\Temp\0013a9fa302baf10fc02be4c127319303b9f6ac410231cd1eabf7295be6b65d4.exe
"C:\Users\Admin\AppData\Local\Temp\0013a9fa302baf10fc02be4c127319303b9f6ac410231cd1eabf7295be6b65d4.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1820
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Saved Games\backgroundTaskHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Videos\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
    - - C:\Users\Admin\Saved Games\backgroundTaskHost.exe
        
        "C:\Users\Admin\Saved Games\backgroundTaskHost.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4472
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gyyX5OxKdc.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3804
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2720
        
        C:\Users\Admin\Saved Games\backgroundTaskHost.exe
        
        "C:\Users\Admin\Saved Games\backgroundTaskHost.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5eI0Zh92hY.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2948
        
        C:\Users\Admin\Saved Games\backgroundTaskHost.exe
        
        "C:\Users\Admin\Saved Games\backgroundTaskHost.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QLPJAVlmCt.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1084
        
        C:\Users\Admin\Saved Games\backgroundTaskHost.exe
        
        "C:\Users\Admin\Saved Games\backgroundTaskHost.exe"
        11⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c0ZYbu3Enn.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:388
        
        C:\Users\Admin\Saved Games\backgroundTaskHost.exe
        
        "C:\Users\Admin\Saved Games\backgroundTaskHost.exe"
        13⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IMpAoVHioU.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2856
        
        C:\Users\Admin\Saved Games\backgroundTaskHost.exe
        
        "C:\Users\Admin\Saved Games\backgroundTaskHost.exe"
        15⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e2wUPJtRJp.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1580
        
        C:\Users\Admin\Saved Games\backgroundTaskHost.exe
        
        "C:\Users\Admin\Saved Games\backgroundTaskHost.exe"
        17⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NDsGBfOUR3.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2792
        
        C:\Users\Admin\Saved Games\backgroundTaskHost.exe
        
        "C:\Users\Admin\Saved Games\backgroundTaskHost.exe"
        19⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5VZ5DKdOS.bat"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4548
        
        C:\Users\Admin\Saved Games\backgroundTaskHost.exe
        
        "C:\Users\Admin\Saved Games\backgroundTaskHost.exe"
        21⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W3ML2JPNvQ.bat"
        22⤵
        
        PID:4044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Saved Games\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Videos\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

System Information Discovery