dcrat | 66ac4015c48cc00c995fc8910d09e2ccc0b559785fc52a959a4d2de9fdb8c62b

Windows Service

T1543.003

Processes:

svchost.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection = 22020100	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2272	schtasks.exe	wmiprvse.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	2272	schtasks.exe	wmiprvse.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

DCRat payload 28 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe	dcrat
\Webdriversession\Intoref.exe	dcrat
behavioral2/memory/1640-106-0x0000000001350000-0x00000000014DC000-memory.dmp	dcrat
behavioral2/memory/272-155-0x00000000013B0000-0x000000000153C000-memory.dmp	dcrat
behavioral2/memory/3952-2018-0x0000000001120000-0x00000000012AC000-memory.dmp	dcrat
behavioral2/memory/4200-2676-0x00000000002B0000-0x000000000043C000-memory.dmp	dcrat
behavioral2/memory/4180-2690-0x00000000000F0000-0x000000000027C000-memory.dmp	dcrat
behavioral2/memory/4108-2892-0x0000000000E40000-0x0000000000FCC000-memory.dmp	dcrat
behavioral2/memory/5032-2891-0x0000000000110000-0x000000000029C000-memory.dmp	dcrat
behavioral2/memory/4360-3071-0x00000000011A0000-0x000000000132C000-memory.dmp	dcrat
behavioral2/memory/5148-3288-0x00000000013A0000-0x000000000152C000-memory.dmp	dcrat
behavioral2/memory/5928-3644-0x00000000010D0000-0x000000000125C000-memory.dmp	dcrat
behavioral2/memory/5940-3837-0x0000000000F60000-0x00000000010EC000-memory.dmp	dcrat
behavioral2/memory/5772-3861-0x00000000011D0000-0x000000000135C000-memory.dmp	dcrat
behavioral2/memory/6988-4044-0x00000000011A0000-0x000000000132C000-memory.dmp	dcrat
behavioral2/memory/6396-4219-0x0000000001310000-0x000000000149C000-memory.dmp	dcrat
behavioral2/memory/5936-4237-0x0000000000250000-0x00000000003DC000-memory.dmp	dcrat
behavioral2/memory/7084-4593-0x00000000011C0000-0x000000000134C000-memory.dmp	dcrat
behavioral2/memory/6552-4613-0x0000000000E40000-0x0000000000FCC000-memory.dmp	dcrat
behavioral2/memory/7852-4982-0x0000000000320000-0x00000000004AC000-memory.dmp	dcrat
behavioral2/memory/8360-5329-0x00000000013A0000-0x000000000152C000-memory.dmp	dcrat
behavioral2/memory/9164-5719-0x0000000000220000-0x00000000003AC000-memory.dmp	dcrat
behavioral2/memory/8668-5917-0x0000000000DA0000-0x0000000000F2C000-memory.dmp	dcrat
behavioral2/memory/9936-6086-0x00000000003E0000-0x000000000056C000-memory.dmp	dcrat
behavioral2/memory/9324-6305-0x00000000011C0000-0x000000000134C000-memory.dmp	dcrat
behavioral2/memory/9408-6304-0x00000000002A0000-0x000000000042C000-memory.dmp	dcrat
behavioral2/memory/8624-6486-0x00000000011D0000-0x000000000135C000-memory.dmp	dcrat
behavioral2/memory/10160-6511-0x0000000001220000-0x00000000013AC000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

1824 powershell.exe
556 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

pid	process
1824	powershell.exe
556	powershell.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

services.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHRAJGDI\ImagePath = "C:\\ProgramData\\nalfdgwigwyg\\lhhsgwktkatl.exe"	services.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

Processes:

Msvchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft_WindowsDefender.lnk	Msvchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft_WindowsDefender.lnk	Msvchost.exe

Executes dropped EXE 37 IoCs

Processes:

Microsoft_Protection.exeMicrosoft_crypt.exeMicrosoft_R.exeMicrosoft_M.exeMsvchost.exeMicrosoft_R.exeMicrosoft_M.exeExplorer.EXEIntoref.exeaudiodg.exelhhsgwktkatl.exeMicrosoft_WindowsDefender.exeMicrosoft_WindowsDefender.exeMicrosoft_WindowsDefender.exeMicrosoft_WindowsDefender.exeMicrosoft_R.exeMicrosoft_WindowsDefender.execmd.exeMicrosoft_crypt.exeaudiodg.exespoolsv.exelsass.exeMicrosoft_R.execonhost.exeMicrosoft_M.exeservices.exeIntoref.exeMicrosoft_R.exeMicrosoft_crypt.execmd.exespoolsv.exeaudiodg.exelsass.exeMicrosoft_R.execonhost.exeMicrosoft_crypt.execmd.exe

pid	process
2912	Microsoft_Protection.exe
2932	Microsoft_crypt.exe
2572	Microsoft_R.exe
2604	Microsoft_M.exe
2460	Msvchost.exe
2892	Microsoft_R.exe
2764	Microsoft_M.exe
1212	Explorer.EXE
1640	Intoref.exe
272	audiodg.exe
1880	lhhsgwktkatl.exe
1132	Microsoft_WindowsDefender.exe
1604	Microsoft_WindowsDefender.exe
2636	Microsoft_WindowsDefender.exe
3156	Microsoft_WindowsDefender.exe
3952	Microsoft_R.exe
3964	Microsoft_WindowsDefender.exe
4200	cmd.exe
4180	Microsoft_crypt.exe
5100	audiodg.exe
5032	spoolsv.exe
4108	lsass.exe
4360	Microsoft_R.exe
5148	conhost.exe
5928	Microsoft_M.exe
5940	services.exe
5772	Intoref.exe
6988	Microsoft_R.exe
6396	Microsoft_crypt.exe
5936	cmd.exe
7084	spoolsv.exe
4428	audiodg.exe
6552	lsass.exe
7852	Microsoft_R.exe
8360	conhost.exe
9192	Microsoft_crypt.exe
9164	cmd.exe

Loads dropped DLL 13 IoCs

Processes:

Vape.exeMicrosoft_R.exeMicrosoft_R.exeMicrosoft_M.exeMicrosoft_M.execmd.exeExplorer.EXEservices.exe

pid	process
3024	Vape.exe
3024	Vape.exe
3024	Vape.exe
3024	Vape.exe
2572	Microsoft_R.exe
2892	Microsoft_R.exe
2604	Microsoft_M.exe
2764	Microsoft_M.exe
1292	cmd.exe
1292	cmd.exe
1212	Explorer.EXE
476	services.exe
476	services.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI25722\python311.dll	upx
behavioral2/memory/2892-86-0x000007FEF1FE0000-0x000007FEF25C9000-memory.dmp	upx
behavioral2/memory/2764-95-0x000007FEF19F0000-0x000007FEF1FD9000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

Msvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft_WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft_WindowsDefender.exe"	Msvchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 pastebin.com
5 pastebin.com
16 pastebin.com

flow	ioc
4	pastebin.com
5	pastebin.com
16	pastebin.com

Drops file in System32 directory 21 IoCs

Processes:

WMIADAP.EXEMicrosoft_crypt.exesvchost.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\perfh00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc010.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc011.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	C:\Windows\system32\MRT.exe	Microsoft_crypt.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	svchost.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfc007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh010.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh011.dat	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE
File created	C:\Windows\system32\perfc00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00C.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

Microsoft_crypt.exe

description pid process target process

PID 2932 set thread context of 764 2932 Microsoft_crypt.exe dialer.exe

description	pid	process	target process
PID 2932 set thread context of 764	2932	Microsoft_crypt.exe	dialer.exe

Drops file in Program Files directory 6 IoCs

Processes:

Intoref.exe

description	ioc	process
File created	C:\Program Files\DVD Maker\en-US\Microsoft_R.exe	Intoref.exe
File created	C:\Program Files\DVD Maker\en-US\2dd33e406c384d	Intoref.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\audiodg.exe	Intoref.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\42af1c969fbb7b	Intoref.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\cmd.exe	Intoref.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ebf1f9fa8afd6d	Intoref.exe

Drops file in Windows directory 18 IoCs

Processes:

Intoref.exewusa.exewusa.exeWMIADAP.EXEsvchost.exe

description	ioc	process
File created	C:\Windows\Help\Windows\de-DE\f3b6ecef712a24	Intoref.exe
File created	C:\Windows\Vss\Writers\conhost.exe	Intoref.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\system\42af1c969fbb7b	Intoref.exe
File created	C:\Windows\Vss\Writers\088424020bedd6	Intoref.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini	WMIADAP.EXE
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\services.exe	Intoref.exe
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\c5b4cb5e9653cc	Intoref.exe
File created	C:\Windows\Help\Windows\de-DE\spoolsv.exe	Intoref.exe
File created	C:\Windows\Logs\DPX\audiodg.exe	Intoref.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\Microsoft_M.exe	Intoref.exe
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\system\audiodg.exe	Intoref.exe
File created	C:\Windows\Logs\DPX\42af1c969fbb7b	Intoref.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\18e71c26c9a8c0	Intoref.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

620 sc.exe
2344 sc.exe
2196 sc.exe
308 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
620	sc.exe
2344	sc.exe
2196	sc.exe
308	sc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Creates scheduled task(s) 1 TTPs 49 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

pid	process
2852	schtasks.exe
2240	schtasks.exe
1556	schtasks.exe
2504	schtasks.exe
2648	schtasks.exe
1540	schtasks.exe
2344	schtasks.exe
2668	schtasks.exe
2616	schtasks.exe
872	schtasks.exe
1040	schtasks.exe
1688	schtasks.exe
2424	schtasks.exe
1512	schtasks.exe
1720	schtasks.exe
1820	schtasks.exe
920	schtasks.exe
2360	schtasks.exe
1828	schtasks.exe
2060	schtasks.exe
1936	schtasks.exe
572	schtasks.exe
2900	schtasks.exe
2600	schtasks.exe
2676	schtasks.exe
1476	schtasks.exe
484	schtasks.exe
1132	schtasks.exe
2040	schtasks.exe
2620	schtasks.exe
2440	schtasks.exe
2476	schtasks.exe
1700	schtasks.exe
1044	schtasks.exe
2916	schtasks.exe
752	schtasks.exe
1868	schtasks.exe
888	schtasks.exe
2168	schtasks.exe
2404	schtasks.exe
1608	schtasks.exe
596	schtasks.exe
3036	schtasks.exe
2200	schtasks.exe
1472	schtasks.exe
1748	schtasks.exe
2552	schtasks.exe
2584	schtasks.exe
1664	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3900 timeout.exe

pid	process
3900	timeout.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

powershell.exedialer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 60bfde074eacda01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Microsoft_crypt.exeIntoref.exeaudiodg.exepowershell.exedialer.exepowershell.exedialer.exewmiprvse.exe

pid	process
2932	Microsoft_crypt.exe
1640	Intoref.exe
1640	Intoref.exe
1640	Intoref.exe
1640	Intoref.exe
1640	Intoref.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
272	audiodg.exe
556	powershell.exe
2932	Microsoft_crypt.exe
2932	Microsoft_crypt.exe
2932	Microsoft_crypt.exe
2932	Microsoft_crypt.exe
2932	Microsoft_crypt.exe
2932	Microsoft_crypt.exe
2932	Microsoft_crypt.exe
764	dialer.exe
764	dialer.exe
764	dialer.exe
764	dialer.exe
764	dialer.exe
764	dialer.exe
2932	Microsoft_crypt.exe
764	dialer.exe
764	dialer.exe
2932	Microsoft_crypt.exe
2932	Microsoft_crypt.exe
764	dialer.exe
764	dialer.exe
764	dialer.exe
764	dialer.exe
1824	powershell.exe
764	dialer.exe
764	dialer.exe
764	dialer.exe
764	dialer.exe
2536	dialer.exe
2536	dialer.exe
2536	dialer.exe
2536	dialer.exe
2536	dialer.exe
2536	dialer.exe
2536	dialer.exe
2536	dialer.exe
272	audiodg.exe
2272	wmiprvse.exe
2272	wmiprvse.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

audiodg.exe

pid process

272 audiodg.exe

pid	process
272	audiodg.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Msvchost.exeIntoref.exeaudiodg.exepowershell.exepowercfg.exedialer.exepowercfg.exepowercfg.exepowercfg.exesvchost.exepowershell.exedialer.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedialer.exewmiprvse.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2460	Msvchost.exe
Token: SeDebugPrivilege	1640	Intoref.exe
Token: SeDebugPrivilege	272	audiodg.exe
Token: SeDebugPrivilege	2460	Msvchost.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeShutdownPrivilege	2820	powercfg.exe
Token: SeDebugPrivilege	764	dialer.exe
Token: SeShutdownPrivilege	1868	powercfg.exe
Token: SeShutdownPrivilege	292	powercfg.exe
Token: SeShutdownPrivilege	2936	powercfg.exe
Token: SeAuditPrivilege	848	svchost.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	2536	dialer.exe
Token: SeShutdownPrivilege	2312	powercfg.exe
Token: SeShutdownPrivilege	2920	powercfg.exe
Token: SeShutdownPrivilege	1472	powercfg.exe
Token: SeShutdownPrivilege	2184	powercfg.exe
Token: SeLockMemoryPrivilege	380	dialer.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe
Token: SeTakeOwnershipPrivilege	848	svchost.exe
Token: SeLoadDriverPrivilege	848	svchost.exe
Token: SeSystemtimePrivilege	848	svchost.exe
Token: SeBackupPrivilege	848	svchost.exe
Token: SeRestorePrivilege	848	svchost.exe
Token: SeShutdownPrivilege	848	svchost.exe
Token: SeSystemEnvironmentPrivilege	848	svchost.exe
Token: SeUndockPrivilege	848	svchost.exe
Token: SeManageVolumePrivilege	848	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe
Token: SeTakeOwnershipPrivilege	848	svchost.exe
Token: SeLoadDriverPrivilege	848	svchost.exe
Token: SeSystemtimePrivilege	848	svchost.exe
Token: SeBackupPrivilege	848	svchost.exe
Token: SeRestorePrivilege	848	svchost.exe
Token: SeShutdownPrivilege	848	svchost.exe
Token: SeSystemEnvironmentPrivilege	848	svchost.exe
Token: SeUndockPrivilege	848	svchost.exe
Token: SeManageVolumePrivilege	848	svchost.exe
Token: SeDebugPrivilege	2272	wmiprvse.exe
Token: SeAuditPrivilege	240	svchost.exe
Token: SeAuditPrivilege	848	svchost.exe
Token: SeAuditPrivilege	848	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe
Token: SeTakeOwnershipPrivilege	848	svchost.exe
Token: SeLoadDriverPrivilege	848	svchost.exe
Token: SeSystemtimePrivilege	848	svchost.exe
Token: SeBackupPrivilege	848	svchost.exe
Token: SeRestorePrivilege	848	svchost.exe
Token: SeShutdownPrivilege	848	svchost.exe
Token: SeSystemEnvironmentPrivilege	848	svchost.exe
Token: SeUndockPrivilege	848	svchost.exe
Token: SeManageVolumePrivilege	848	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe
Token: SeTakeOwnershipPrivilege	848	svchost.exe
Token: SeLoadDriverPrivilege	848	svchost.exe
Token: SeSystemtimePrivilege	848	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE
1212 Explorer.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

conhost.exe

pid process

3596 conhost.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

svchost.exe

pid process

848 svchost.exe

pid	process
1212	Explorer.EXE

pid	process
1212	Explorer.EXE
1212	Explorer.EXE

pid	process
3596	conhost.exe

pid	process
848	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Vape.exeMicrosoft_Protection.exeMicrosoft_R.exeMicrosoft_M.exeMsvchost.exeWScript.execmd.exeIntoref.exeMicrosoft_crypt.exedialer.execmd.exe

description	pid	process	target process
PID 3024 wrote to memory of 2912	3024	Vape.exe	Microsoft_Protection.exe
PID 3024 wrote to memory of 2912	3024	Vape.exe	Microsoft_Protection.exe
PID 3024 wrote to memory of 2912	3024	Vape.exe	Microsoft_Protection.exe
PID 3024 wrote to memory of 2912	3024	Vape.exe	Microsoft_Protection.exe
PID 3024 wrote to memory of 2932	3024	Vape.exe	Microsoft_crypt.exe
PID 3024 wrote to memory of 2932	3024	Vape.exe	Microsoft_crypt.exe
PID 3024 wrote to memory of 2932	3024	Vape.exe	Microsoft_crypt.exe
PID 2912 wrote to memory of 2688	2912	Microsoft_Protection.exe	WScript.exe
PID 2912 wrote to memory of 2688	2912	Microsoft_Protection.exe	WScript.exe
PID 2912 wrote to memory of 2688	2912	Microsoft_Protection.exe	WScript.exe
PID 2912 wrote to memory of 2688	2912	Microsoft_Protection.exe	WScript.exe
PID 3024 wrote to memory of 2572	3024	Vape.exe	Microsoft_R.exe
PID 3024 wrote to memory of 2572	3024	Vape.exe	Microsoft_R.exe
PID 3024 wrote to memory of 2572	3024	Vape.exe	Microsoft_R.exe
PID 3024 wrote to memory of 2604	3024	Vape.exe	Microsoft_M.exe
PID 3024 wrote to memory of 2604	3024	Vape.exe	Microsoft_M.exe
PID 3024 wrote to memory of 2604	3024	Vape.exe	Microsoft_M.exe
PID 3024 wrote to memory of 2460	3024	Vape.exe	Msvchost.exe
PID 3024 wrote to memory of 2460	3024	Vape.exe	Msvchost.exe
PID 3024 wrote to memory of 2460	3024	Vape.exe	Msvchost.exe
PID 2572 wrote to memory of 2892	2572	Microsoft_R.exe	Microsoft_R.exe
PID 2572 wrote to memory of 2892	2572	Microsoft_R.exe	Microsoft_R.exe
PID 2572 wrote to memory of 2892	2572	Microsoft_R.exe	Microsoft_R.exe
PID 2604 wrote to memory of 2764	2604	Microsoft_M.exe	Microsoft_M.exe
PID 2604 wrote to memory of 2764	2604	Microsoft_M.exe	Microsoft_M.exe
PID 2604 wrote to memory of 2764	2604	Microsoft_M.exe	Microsoft_M.exe
PID 2460 wrote to memory of 1040	2460	Msvchost.exe	schtasks.exe
PID 2460 wrote to memory of 1040	2460	Msvchost.exe	schtasks.exe
PID 2460 wrote to memory of 1040	2460	Msvchost.exe	schtasks.exe
PID 2688 wrote to memory of 1292	2688	WScript.exe	cmd.exe
PID 2688 wrote to memory of 1292	2688	WScript.exe	cmd.exe
PID 2688 wrote to memory of 1292	2688	WScript.exe	cmd.exe
PID 2688 wrote to memory of 1292	2688	WScript.exe	cmd.exe
PID 1292 wrote to memory of 1640	1292	cmd.exe	Intoref.exe
PID 1292 wrote to memory of 1640	1292	cmd.exe	Intoref.exe
PID 1292 wrote to memory of 1640	1292	cmd.exe	Intoref.exe
PID 1292 wrote to memory of 1640	1292	cmd.exe	Intoref.exe
PID 1640 wrote to memory of 272	1640	Intoref.exe	audiodg.exe
PID 1640 wrote to memory of 272	1640	Intoref.exe	audiodg.exe
PID 1640 wrote to memory of 272	1640	Intoref.exe	audiodg.exe
PID 2932 wrote to memory of 764	2932	Microsoft_crypt.exe	dialer.exe
PID 2932 wrote to memory of 764	2932	Microsoft_crypt.exe	dialer.exe
PID 2932 wrote to memory of 764	2932	Microsoft_crypt.exe	dialer.exe
PID 2932 wrote to memory of 764	2932	Microsoft_crypt.exe	dialer.exe
PID 2932 wrote to memory of 764	2932	Microsoft_crypt.exe	dialer.exe
PID 2932 wrote to memory of 764	2932	Microsoft_crypt.exe	dialer.exe
PID 2932 wrote to memory of 764	2932	Microsoft_crypt.exe	dialer.exe
PID 764 wrote to memory of 424	764	dialer.exe	winlogon.exe
PID 764 wrote to memory of 476	764	dialer.exe	services.exe
PID 764 wrote to memory of 492	764	dialer.exe	lsass.exe
PID 1480 wrote to memory of 2592	1480	cmd.exe	wusa.exe
PID 1480 wrote to memory of 2592	1480	cmd.exe	wusa.exe
PID 1480 wrote to memory of 2592	1480	cmd.exe	wusa.exe
PID 764 wrote to memory of 500	764	dialer.exe	lsm.exe
PID 764 wrote to memory of 608	764	dialer.exe	svchost.exe
PID 764 wrote to memory of 684	764	dialer.exe	svchost.exe
PID 764 wrote to memory of 772	764	dialer.exe	svchost.exe
PID 764 wrote to memory of 812	764	dialer.exe	svchost.exe
PID 764 wrote to memory of 848	764	dialer.exe	svchost.exe
PID 764 wrote to memory of 972	764	dialer.exe	svchost.exe
PID 764 wrote to memory of 240	764	dialer.exe	svchost.exe
PID 764 wrote to memory of 296	764	dialer.exe	spoolsv.exe
PID 764 wrote to memory of 1076	764	dialer.exe	svchost.exe
PID 764 wrote to memory of 1112	764	dialer.exe	taskhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Sets service image path in registry
- Loads dropped DLL
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:608

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Default\lsass.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\lsass.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Default\lsass.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IntorefI" /sc MINUTE /mo 8 /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\Intoref.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Intoref" /sc ONLOGON /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\Intoref.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IntorefI" /sc MINUTE /mo 14 /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\Intoref.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\services.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\services.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\services.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Windows\system\audiodg.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\system\audiodg.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Windows\system\audiodg.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\audiodg.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\audiodg.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\audiodg.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_RM" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Videos\Microsoft_R.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_R" /sc ONLOGON /tr "'C:\Users\Default\Videos\Microsoft_R.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_RM" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Videos\Microsoft_R.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Webdriversession\lsass.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Webdriversession\lsass.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Webdriversession\lsass.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jdk1.7.0_80\lib\cmd.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\lib\cmd.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jdk1.7.0_80\lib\cmd.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\spoolsv.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\spoolsv.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\spoolsv.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\cmd.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\cmd.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\cmd.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_RM" /sc MINUTE /mo 13 /tr "'C:\Program Files\DVD Maker\en-US\Microsoft_R.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_R" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\en-US\Microsoft_R.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_RM" /sc MINUTE /mo 5 /tr "'C:\Program Files\DVD Maker\en-US\Microsoft_R.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\Help\Windows\de-DE\spoolsv.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Help\Windows\de-DE\spoolsv.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\Windows\de-DE\spoolsv.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\Vss\Writers\conhost.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\conhost.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\Vss\Writers\conhost.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Windows\Logs\DPX\audiodg.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Logs\DPX\audiodg.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Windows\Logs\DPX\audiodg.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_cryptM" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Microsoft_crypt.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_crypt" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Microsoft_crypt.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_cryptM" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Microsoft_crypt.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_MM" /sc MINUTE /mo 7 /tr "'C:\Windows\RemotePackages\RemoteDesktops\Microsoft_M.exe'" /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_M" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\Microsoft_M.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Microsoft_MM" /sc MINUTE /mo 13 /tr "'C:\Windows\RemotePackages\RemoteDesktops\Microsoft_M.exe'" /rl HIGHEST /f
4⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
3⤵
PID:484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
- Modifies security service
- Drops file in System32 directory
PID:772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:812

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
3⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:848

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
3⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2844

C:\Windows\system32\taskeng.exe
taskeng.exe {64F605D3-18F1-4015-BDFF-F94BEFFF9646} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
3⤵
PID:2576

C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
4⤵
- Executes dropped EXE
PID:1132

C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
4⤵
- Executes dropped EXE
PID:1604

C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
4⤵
- Executes dropped EXE
PID:2636

C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
4⤵
- Executes dropped EXE
PID:3156

C:\Program Files\DVD Maker\en-US\Microsoft_R.exe
"C:\Program Files\DVD Maker\en-US\Microsoft_R.exe"
4⤵
- Executes dropped EXE
PID:3952

C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
4⤵
- Executes dropped EXE
PID:3964

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Microsoft_crypt.exe
"C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Microsoft_crypt.exe"
4⤵
- Executes dropped EXE
PID:4180

C:\Program Files\Java\jdk1.7.0_80\lib\cmd.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\cmd.exe"
4⤵
- Executes dropped EXE
PID:4200

C:\Windows\Help\Windows\de-DE\spoolsv.exe
C:\Windows\Help\Windows\de-DE\spoolsv.exe
4⤵
- Executes dropped EXE
PID:5032

C:\Windows\Logs\DPX\audiodg.exe
C:\Windows\Logs\DPX\audiodg.exe
4⤵
- Executes dropped EXE
PID:5100

C:\Webdriversession\lsass.exe
C:\Webdriversession\lsass.exe
4⤵
- Executes dropped EXE
PID:4108

C:\Program Files\DVD Maker\en-US\Microsoft_R.exe
"C:\Program Files\DVD Maker\en-US\Microsoft_R.exe"
4⤵
- Executes dropped EXE
PID:4360

C:\Windows\Vss\Writers\conhost.exe
C:\Windows\Vss\Writers\conhost.exe
4⤵
- Executes dropped EXE
PID:5148

C:\Windows\RemotePackages\RemoteDesktops\Microsoft_M.exe
C:\Windows\RemotePackages\RemoteDesktops\Microsoft_M.exe
4⤵
- Executes dropped EXE
PID:5928

C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\Intoref.exe
C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\Intoref.exe
4⤵
- Executes dropped EXE
PID:5772

C:\Windows\PCHEALTH\ERRORREP\QHEADLES\services.exe
C:\Windows\PCHEALTH\ERRORREP\QHEADLES\services.exe
4⤵
- Executes dropped EXE
PID:5940

C:\Program Files\DVD Maker\en-US\Microsoft_R.exe
"C:\Program Files\DVD Maker\en-US\Microsoft_R.exe"
4⤵
- Executes dropped EXE
PID:6988

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Microsoft_crypt.exe
"C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Microsoft_crypt.exe"
4⤵
- Executes dropped EXE
PID:6396

C:\Program Files\Java\jdk1.7.0_80\lib\cmd.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\cmd.exe"
4⤵
- Executes dropped EXE
PID:5936

C:\Windows\Help\Windows\de-DE\spoolsv.exe
C:\Windows\Help\Windows\de-DE\spoolsv.exe
4⤵
- Executes dropped EXE
PID:7084

C:\Webdriversession\lsass.exe
C:\Webdriversession\lsass.exe
4⤵
- Executes dropped EXE
PID:6552

C:\Windows\Logs\DPX\audiodg.exe
C:\Windows\Logs\DPX\audiodg.exe
4⤵
- Executes dropped EXE
PID:4428

C:\Program Files\DVD Maker\en-US\Microsoft_R.exe
"C:\Program Files\DVD Maker\en-US\Microsoft_R.exe"
4⤵
- Executes dropped EXE
PID:7852

C:\Windows\Vss\Writers\conhost.exe
C:\Windows\Vss\Writers\conhost.exe
4⤵
- Executes dropped EXE
PID:8360

C:\Program Files\Java\jdk1.7.0_80\lib\cmd.exe
"C:\Program Files\Java\jdk1.7.0_80\lib\cmd.exe"
4⤵
- Executes dropped EXE
PID:9164

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Microsoft_crypt.exe
"C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Microsoft_crypt.exe"
4⤵
- Executes dropped EXE
PID:9192

C:\Program Files\DVD Maker\en-US\Microsoft_R.exe
"C:\Program Files\DVD Maker\en-US\Microsoft_R.exe"
4⤵
PID:8668

C:\Windows\RemotePackages\RemoteDesktops\Microsoft_M.exe
C:\Windows\RemotePackages\RemoteDesktops\Microsoft_M.exe
4⤵
PID:9936

C:\Windows\Help\Windows\de-DE\spoolsv.exe
C:\Windows\Help\Windows\de-DE\spoolsv.exe
4⤵
PID:9324

C:\Windows\Logs\DPX\audiodg.exe
C:\Windows\Logs\DPX\audiodg.exe
4⤵
PID:9360

C:\Webdriversession\lsass.exe
C:\Webdriversession\lsass.exe
4⤵
PID:9408

C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\Intoref.exe
C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\Intoref.exe
4⤵
PID:8624

C:\Windows\PCHEALTH\ERRORREP\QHEADLES\services.exe
C:\Windows\PCHEALTH\ERRORREP\QHEADLES\services.exe
4⤵
PID:10160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:240

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1076

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:3020

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:2980

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
2⤵
PID:1324

C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe
C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe
2⤵
- Executes dropped EXE
PID:1880

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:348

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
- Drops file in Windows directory
PID:2140

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
3⤵
PID:988

C:\Windows\system32\dialer.exe
dialer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:500

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1212

C:\Users\Admin\AppData\Local\Temp\Vape.exe
"C:\Users\Admin\AppData\Local\Temp\Vape.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024

C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Webdriversession\gI2DkJwTD.vbe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Webdriversession\SoPkc.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1292

C:\Webdriversession\Intoref.exe
"C:\Webdriversession\Intoref.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\Logs\DPX\audiodg.exe
"C:\Windows\Logs\DPX\audiodg.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:272

C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
4⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
5⤵
- Drops file in Windows directory
PID:2592

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:292

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "QHRAJGDI"
4⤵
- Launches sc.exe
PID:620

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "QHRAJGDI" binpath= "C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe" start= "auto"
4⤵
- Launches sc.exe
PID:2344

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
4⤵
- Launches sc.exe
PID:308

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "QHRAJGDI"
4⤵
- Launches sc.exe
PID:2196

C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572

C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892

C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604

C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764

C:\Users\Admin\AppData\Local\Temp\Msvchost.exe
"C:\Users\Admin\AppData\Local\Temp\Msvchost.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft_WindowsDefender" /tr "C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe"
4⤵
- Creates scheduled task(s)
PID:1040

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /delete /f /tn "Microsoft_WindowsDefender"
4⤵
PID:3548

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD01B.tmp.bat""
4⤵
PID:3652

C:\Windows\system32\timeout.exe
timeout 3
5⤵
- Delays execution with timeout.exe
PID:3900

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "517737677-2091385032699035572-1681669001-1039688454-9878025651266299741-1274865964"
1⤵
PID:2032

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1945159428-229233257515224023-1226832650746010515697778382-36427008-1289751006"
1⤵
PID:1092

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1957606319-749594014419580594-10710068195298585241220521706-381202372-530876664"
1⤵
PID:2000

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "74405533912956628961515117994845383343-574850553-1865636630-1426968566-1409060410"
1⤵
PID:3016

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "5539468205728206631098712358-1677732721-195303534010150220832131724675-2139962527"
1⤵
PID:1504

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-736764901-1108944474-1251216617-194455120416287924756946439271324079723-341354849"
1⤵
PID:1716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-864087805114936000-845493241-687788432-266637780-519849317-111851805-1289643673"
1⤵
PID:1448

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2069603890-1314974898-1268921114790684153532941142798012780-17058278811250609004"
1⤵
PID:2416

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1537145819652152319918431907-1346657914963525201-387782238565408801974495004"
1⤵
PID:916

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-94716821-1659672603-1110648981-1123641425-1484305853511591874-10461069361562918565"
1⤵
PID:2928

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-358615548-2066580218-2050893093285140012-596561501229984291-19374974441367090891"
1⤵
PID:1764

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-18597445641750336602-226328129-2126950900-1137569895651241731-3603652511490528016"
1⤵
PID:2540

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "122224658216808240121354486489942540297-300244203-1762754479-1234687511-216217052"
1⤵
PID:708

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1686194882-14911466662089910672714552053746035821-1688816004-2089988255891254745"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3596

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1648613051-83604294512956652091203226532-712943166-2025999951-276924462-1481030271"
1⤵
PID:3680

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Scheduled Task/Job

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry