colibri | ae9589d8290da8ddfbc081f3ecdb50857abcb22a7977d0c957f81b625a361781

Analysis

max time kernel
118s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Size

4.9MB
MD5

3b6fd6541d4ddab0edbd51aa2f87e2b0
SHA1

a3e3dd0b42b506cab76d452088db7555dbdfa9fc
SHA256

ae9589d8290da8ddfbc081f3ecdb50857abcb22a7977d0c957f81b625a361781
SHA512

e9a5689f29ca646e76f5699a26a0ae5ed1b6a9e3a10260571f95ec15da1bb4bea1cf216035b4cbbe3a004884a233885d6cb779335de73b3f9521095994dd2b4a
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	2736	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2736	schtasks.exe	85

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1900-2-0x000000001B9E0000-0x000000001BB0E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2336	powershell.exe
2364	powershell.exe
4968	powershell.exe
3284	powershell.exe
1456	powershell.exe
964	powershell.exe
4712	powershell.exe
2536	powershell.exe
3908	powershell.exe
4924	powershell.exe
1948	powershell.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	wininit.exe

Executes dropped EXE 43 IoCs

pid	Process
4000	tmpB8C4.tmp.exe
3432	tmpB8C4.tmp.exe
1564	tmpB8C4.tmp.exe
1944	tmpB8C4.tmp.exe
5092	tmpB8C4.tmp.exe
3964	wininit.exe
4760	tmpF368.tmp.exe
5112	tmpF368.tmp.exe
4480	wininit.exe
3312	tmp10E3.tmp.exe
1656	tmp10E3.tmp.exe
3636	tmp10E3.tmp.exe
3208	wininit.exe
4584	tmp2CF7.tmp.exe
1560	tmp2CF7.tmp.exe
4292	wininit.exe
3284	tmp49E5.tmp.exe
2364	tmp49E5.tmp.exe
4696	tmp49E5.tmp.exe
4660	wininit.exe
4164	tmp7C30.tmp.exe
1148	tmp7C30.tmp.exe
4452	wininit.exe
1264	tmpAE0E.tmp.exe
4996	tmpAE0E.tmp.exe
508	wininit.exe
1944	tmpDFBC.tmp.exe
2480	tmpDFBC.tmp.exe
4108	tmpDFBC.tmp.exe
2568	wininit.exe
2372	tmpFB34.tmp.exe
2292	tmpFB34.tmp.exe
2772	tmpFB34.tmp.exe
2608	wininit.exe
1316	tmp2B4C.tmp.exe
2856	tmp2B4C.tmp.exe
3092	tmp2B4C.tmp.exe
4308	wininit.exe
4300	tmp47AE.tmp.exe
1692	tmp47AE.tmp.exe
1632	wininit.exe
1636	tmp792E.tmp.exe
1584	tmp792E.tmp.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 5092	1944	tmpB8C4.tmp.exe	132
PID 4760 set thread context of 5112	4760	tmpF368.tmp.exe	166
PID 1656 set thread context of 3636	1656	tmp10E3.tmp.exe	173
PID 4584 set thread context of 1560	4584	tmp2CF7.tmp.exe	181
PID 2364 set thread context of 4696	2364	tmp49E5.tmp.exe	188
PID 4164 set thread context of 1148	4164	tmp7C30.tmp.exe	194
PID 1264 set thread context of 4996	1264	tmpAE0E.tmp.exe	200
PID 2480 set thread context of 4108	2480	tmpDFBC.tmp.exe	207
PID 2292 set thread context of 2772	2292	tmpFB34.tmp.exe	214
PID 2856 set thread context of 3092	2856	tmp2B4C.tmp.exe	221
PID 4300 set thread context of 1692	4300	tmp47AE.tmp.exe	227
PID 1636 set thread context of 1584	1636	tmp792E.tmp.exe	233

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\56085415360792	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXBD2C.tmp	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\RCXC1C2.tmp	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\backgroundTaskHost.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Program Files\VideoLAN\VLC\Registry.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Program Files\VideoLAN\VLC\ee2ad38f3d4382	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\Registry.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\RCXC462.tmp	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\wininit.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Program Files\WindowsPowerShell\Modules\backgroundTaskHost.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\sppsvc.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\0a1fd5f707cd16	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCXB4BA.tmp	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\sppsvc.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\RCXCA9F.tmp	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\5940a34987c991	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Program Files\WindowsPowerShell\Modules\eddb19405b7ce1	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Program Files\MSBuild\Microsoft\wininit.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\appcompat\appraiser\Telemetry\lsass.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCXCCA4.tmp	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Windows\Cursors\sysmon.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Windows\appcompat\appraiser\Telemetry\6203df4a6bafc7	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Windows\DigitalLocker\en-US\services.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Windows\DigitalLocker\en-US\c5b4cb5e9653cc	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Windows\Cursors\RCXC686.tmp	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Windows\Cursors\sysmon.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Windows\appcompat\appraiser\Telemetry\RCXC89B.tmp	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Windows\appcompat\appraiser\Telemetry\lsass.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File created	C:\Windows\Cursors\121e5b5079f7c0	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\services.exe	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB8C4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB8C4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB8C4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp10E3.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2CF7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp49E5.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2B4C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp47AE.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDFBC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpFB34.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpFB34.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2B4C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB8C4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp10E3.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp49E5.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDFBC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp792E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF368.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7C30.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAE0E.tmp.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	wininit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1076	schtasks.exe
4660	schtasks.exe
2772	schtasks.exe
2068	schtasks.exe
1152	schtasks.exe
116	schtasks.exe
212	schtasks.exe
2156	schtasks.exe
2400	schtasks.exe
1940	schtasks.exe
2020	schtasks.exe
4832	schtasks.exe
4652	schtasks.exe
4948	schtasks.exe
4964	schtasks.exe
2644	schtasks.exe
3940	schtasks.exe
2784	schtasks.exe
3668	schtasks.exe
668	schtasks.exe
2352	schtasks.exe
528	schtasks.exe
1184	schtasks.exe
4752	schtasks.exe
1324	schtasks.exe
2816	schtasks.exe
2536	schtasks.exe
2160	schtasks.exe
4200	schtasks.exe
3976	schtasks.exe
4656	schtasks.exe
3864	schtasks.exe
628	schtasks.exe
1656	schtasks.exe
4680	schtasks.exe
5064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
4968	powershell.exe
4968	powershell.exe
2364	powershell.exe
2364	powershell.exe
964	powershell.exe
964	powershell.exe
2336	powershell.exe
2336	powershell.exe
2536	powershell.exe
2536	powershell.exe
3908	powershell.exe
3908	powershell.exe
3284	powershell.exe
3284	powershell.exe
1948	powershell.exe
1948	powershell.exe
4924	powershell.exe
4924	powershell.exe
1456	powershell.exe
1456	powershell.exe
3284	powershell.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe
4968	powershell.exe
4968	powershell.exe
964	powershell.exe
964	powershell.exe
2336	powershell.exe
2336	powershell.exe
3908	powershell.exe
1948	powershell.exe
2536	powershell.exe
2536	powershell.exe
2364	powershell.exe
2364	powershell.exe
4924	powershell.exe
1456	powershell.exe
3964	wininit.exe
4480	wininit.exe
3208	wininit.exe
4292	wininit.exe
4660	wininit.exe
4452	wininit.exe
508	wininit.exe
2568	wininit.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	3284	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	3964	wininit.exe
Token: SeDebugPrivilege	4480	wininit.exe
Token: SeDebugPrivilege	3208	wininit.exe
Token: SeDebugPrivilege	4292	wininit.exe
Token: SeDebugPrivilege	4660	wininit.exe
Token: SeDebugPrivilege	4452	wininit.exe
Token: SeDebugPrivilege	508	wininit.exe
Token: SeDebugPrivilege	2568	wininit.exe
Token: SeDebugPrivilege	2608	wininit.exe
Token: SeDebugPrivilege	4308	wininit.exe
Token: SeDebugPrivilege	1632	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 4000	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	126
PID 1900 wrote to memory of 4000	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	126
PID 1900 wrote to memory of 4000	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	126
PID 4000 wrote to memory of 3432	4000	tmpB8C4.tmp.exe	129
PID 4000 wrote to memory of 3432	4000	tmpB8C4.tmp.exe	129
PID 4000 wrote to memory of 3432	4000	tmpB8C4.tmp.exe	129
PID 3432 wrote to memory of 1564	3432	tmpB8C4.tmp.exe	130
PID 3432 wrote to memory of 1564	3432	tmpB8C4.tmp.exe	130
PID 3432 wrote to memory of 1564	3432	tmpB8C4.tmp.exe	130
PID 1564 wrote to memory of 1944	1564	tmpB8C4.tmp.exe	131
PID 1564 wrote to memory of 1944	1564	tmpB8C4.tmp.exe	131
PID 1564 wrote to memory of 1944	1564	tmpB8C4.tmp.exe	131
PID 1944 wrote to memory of 5092	1944	tmpB8C4.tmp.exe	132
PID 1944 wrote to memory of 5092	1944	tmpB8C4.tmp.exe	132
PID 1944 wrote to memory of 5092	1944	tmpB8C4.tmp.exe	132
PID 1944 wrote to memory of 5092	1944	tmpB8C4.tmp.exe	132
PID 1944 wrote to memory of 5092	1944	tmpB8C4.tmp.exe	132
PID 1944 wrote to memory of 5092	1944	tmpB8C4.tmp.exe	132
PID 1944 wrote to memory of 5092	1944	tmpB8C4.tmp.exe	132
PID 1900 wrote to memory of 4712	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	134
PID 1900 wrote to memory of 4712	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	134
PID 1900 wrote to memory of 2364	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	135
PID 1900 wrote to memory of 2364	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	135
PID 1900 wrote to memory of 2536	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	136
PID 1900 wrote to memory of 2536	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	136
PID 1900 wrote to memory of 2336	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	137
PID 1900 wrote to memory of 2336	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	137
PID 1900 wrote to memory of 4968	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	138
PID 1900 wrote to memory of 4968	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	138
PID 1900 wrote to memory of 3908	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	139
PID 1900 wrote to memory of 3908	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	139
PID 1900 wrote to memory of 3284	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	140
PID 1900 wrote to memory of 3284	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	140
PID 1900 wrote to memory of 1456	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	141
PID 1900 wrote to memory of 1456	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	141
PID 1900 wrote to memory of 964	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	142
PID 1900 wrote to memory of 964	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	142
PID 1900 wrote to memory of 4924	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	143
PID 1900 wrote to memory of 4924	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	143
PID 1900 wrote to memory of 1948	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	144
PID 1900 wrote to memory of 1948	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	144
PID 1900 wrote to memory of 2384	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	151
PID 1900 wrote to memory of 2384	1900	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe	151
PID 2384 wrote to memory of 2340	2384	cmd.exe	159
PID 2384 wrote to memory of 2340	2384	cmd.exe	159
PID 2384 wrote to memory of 3964	2384	cmd.exe	161
PID 2384 wrote to memory of 3964	2384	cmd.exe	161
PID 3964 wrote to memory of 2804	3964	wininit.exe	162
PID 3964 wrote to memory of 2804	3964	wininit.exe	162
PID 3964 wrote to memory of 1748	3964	wininit.exe	163
PID 3964 wrote to memory of 1748	3964	wininit.exe	163
PID 3964 wrote to memory of 4760	3964	wininit.exe	164
PID 3964 wrote to memory of 4760	3964	wininit.exe	164
PID 3964 wrote to memory of 4760	3964	wininit.exe	164
PID 4760 wrote to memory of 5112	4760	tmpF368.tmp.exe	166
PID 4760 wrote to memory of 5112	4760	tmpF368.tmp.exe	166
PID 4760 wrote to memory of 5112	4760	tmpF368.tmp.exe	166
PID 4760 wrote to memory of 5112	4760	tmpF368.tmp.exe	166
PID 4760 wrote to memory of 5112	4760	tmpF368.tmp.exe	166
PID 4760 wrote to memory of 5112	4760	tmpF368.tmp.exe	166
PID 4760 wrote to memory of 5112	4760	tmpF368.tmp.exe	166
PID 2804 wrote to memory of 4480	2804	WScript.exe	167
PID 2804 wrote to memory of 4480	2804	WScript.exe	167
PID 4480 wrote to memory of 1940	4480	wininit.exe	168

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe
"C:\Users\Admin\AppData\Local\Temp\3b6fd6541d4ddab0edbd51aa2f87e2b0N.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1900
- C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uSm9iCqX6P.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2340
- - C:\Users\Default\Local Settings\wininit.exe
    "C:\Users\Default\Local Settings\wininit.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3964
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eef4a9f7-2468-45a1-8e91-89b8d21eafe4.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Users\Default\Local Settings\wininit.exe
        
        "C:\Users\Default\Local Settings\wininit.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4480
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b69463d-214e-4bb5-b08c-bf48abcf44f0.vbs"
        6⤵
        
        PID:1940
        
        C:\Users\Default\Local Settings\wininit.exe
        
        "C:\Users\Default\Local Settings\wininit.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d979c87e-6cb5-4c3e-ac93-9cb3b1906b1d.vbs"
        8⤵
        
        PID:3240
        
        C:\Users\Default\Local Settings\wininit.exe
        
        "C:\Users\Default\Local Settings\wininit.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d91be530-a696-4d13-9a72-a07e9f6f4316.vbs"
        10⤵
        
        PID:2020
        
        C:\Users\Default\Local Settings\wininit.exe
        
        "C:\Users\Default\Local Settings\wininit.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\727ffb44-abd2-4331-9429-39c6a9c629c3.vbs"
        12⤵
        
        PID:1780
        
        C:\Users\Default\Local Settings\wininit.exe
        
        "C:\Users\Default\Local Settings\wininit.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b5d81ae-0ff4-4a04-a8f4-d3ec278d00a3.vbs"
        14⤵
        
        PID:1792
        
        C:\Users\Default\Local Settings\wininit.exe
        
        "C:\Users\Default\Local Settings\wininit.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9daf70ab-f94e-4ca1-b1d6-6cce726c5ece.vbs"
        16⤵
        
        PID:364
        
        C:\Users\Default\Local Settings\wininit.exe
        
        "C:\Users\Default\Local Settings\wininit.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7aef83aa-d409-4979-9269-4651cf79cd02.vbs"
        18⤵
        
        PID:2836
        
        C:\Users\Default\Local Settings\wininit.exe
        
        "C:\Users\Default\Local Settings\wininit.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1b79206-6fa1-4aa5-badf-1fa2209812a3.vbs"
        20⤵
        
        PID:1836
        
        C:\Users\Default\Local Settings\wininit.exe
        
        "C:\Users\Default\Local Settings\wininit.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f2e4f88-8b53-4e8c-a296-765514fcd4f1.vbs"
        22⤵
        
        PID:5088
        
        C:\Users\Default\Local Settings\wininit.exe
        
        "C:\Users\Default\Local Settings\wininit.exe"
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34348586-8fa6-47de-b288-4ab96ab775b6.vbs"
        24⤵
        
        PID:4764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fc20776-783c-4866-85f5-bb638552efa6.vbs"
        24⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\tmp792E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp792E.tmp.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\tmp792E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp792E.tmp.exe"
        25⤵
        Executes dropped EXE
        
        PID:1584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc785938-6ddc-4ef7-95ce-f8deeaf67ca7.vbs"
        22⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\tmp47AE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp47AE.tmp.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\tmp47AE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp47AE.tmp.exe"
        23⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\707c5011-fac7-4a8a-964f-cf08c61598f7.vbs"
        20⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\tmp2B4C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2B4C.tmp.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\tmp2B4C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2B4C.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\tmp2B4C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2B4C.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:3092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bcbdcec7-3023-4bf3-a261-4fdf51c43d3a.vbs"
        18⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\tmpFB34.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFB34.tmp.exe"
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\tmpFB34.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFB34.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\tmpFB34.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFB34.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:2772
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7fe580c-a602-4813-81bc-4249d5b2c43d.vbs"
        16⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\tmpDFBC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDFBC.tmp.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\tmpDFBC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDFBC.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\tmpDFBC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDFBC.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\559170b1-83b1-4595-a432-9786feba8fbf.vbs"
        14⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\tmpAE0E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAE0E.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\tmpAE0E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAE0E.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f0f938b-9659-436e-b380-493e81db8e1f.vbs"
        12⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\tmp7C30.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7C30.tmp.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\tmp7C30.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7C30.tmp.exe"
        13⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5186b0d-bb3e-4be3-ac94-60a4a3bb7d82.vbs"
        10⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\tmp49E5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp49E5.tmp.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\tmp49E5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp49E5.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\tmp49E5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp49E5.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:4696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6dfeaf06-ea79-4f39-9a5b-360ab361a0c5.vbs"
        8⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\tmp2CF7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2CF7.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\tmp2CF7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2CF7.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:1560
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81681965-ebd2-406c-95f9-c36affae33ce.vbs"
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\tmp10E3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp10E3.tmp.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\tmp10E3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp10E3.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\tmp10E3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp10E3.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:3636
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11353a71-0d01-4e0f-9329-ffb1d5997a2b.vbs"
      4⤵
      PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\tmpF368.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpF368.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\tmpF368.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF368.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Users\Public\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Public\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Local Settings\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Local Settings\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Downloads\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default\Downloads\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Downloads\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Modules\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\Modules\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\PackageManifests\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\PackageManifests\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Windows\Cursors\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Cursors\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Windows\Cursors\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\appcompat\appraiser\Telemetry\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\appcompat\appraiser\Telemetry\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\appcompat\appraiser\Telemetry\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\VideoLAN\VLC\Registry.exe

Filesize
4.9MB

MD5
3b6fd6541d4ddab0edbd51aa2f87e2b0

SHA1
a3e3dd0b42b506cab76d452088db7555dbdfa9fc

SHA256
ae9589d8290da8ddfbc081f3ecdb50857abcb22a7977d0c957f81b625a361781

SHA512
e9a5689f29ca646e76f5699a26a0ae5ed1b6a9e3a10260571f95ec15da1bb4bea1cf216035b4cbbe3a004884a233885d6cb779335de73b3f9521095994dd2b4a

Download Submit
C:\Program Files\WindowsPowerShell\Modules\backgroundTaskHost.exe

Filesize
4.9MB

MD5
1f6c557ae3d88c0d370051d777e18eea

SHA1
fb868baec9efe0682f52c6838dd1b07ab757b6fc

SHA256
229e862270399a26081015f3cf0473f4d3945deded0142acfbc5b23300e996b6

SHA512
cb058d20bf832b6cd983ba5bb7dcf044b45cf0ec2c94e4e622d2fa315d85e18b65f72b2d1ca7e47b35ed07e926db48979bed4ffd63110ce49b039bdb4d1dcda0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\0b5d81ae-0ff4-4a04-a8f4-d3ec278d00a3.vbs

Filesize
719B

MD5
baa7208224b5bea17e56441b73950ab6

SHA1
571e59caab494599a2eee2b4bf0ebfb8297b0fad

SHA256
a9c0c9e8d3b995a5f4f0e3f0e63a257a4fb2808a85ff27f02e0cdd504c59b92c

SHA512
d08b9c24889d389f43798ec319fc7d9db3ef3697def19d5989c33683993add64fefd616ed698d054ce213bd16944b0ad901e1e6b2235f746eb5704a12d234d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\11353a71-0d01-4e0f-9329-ffb1d5997a2b.vbs

Filesize
495B

MD5
d02f2c98f3e322529035eae50086093a

SHA1
91252862bfc672bfe8ba5040c517a0fa252534bf

SHA256
9342c8d1a121fb35561de9c4bae535ef017c37fa9ed09b95eb3660ee6045e6b5

SHA512
ea8de97d385287f2cc075e94a53549be2651c86362b4c1f7152c90eed6ed54681f36535ac8410727edf758f1e6cfe5d8faaa868940e736dbc894c99c10178c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\6b69463d-214e-4bb5-b08c-bf48abcf44f0.vbs

Filesize
719B

MD5
ea696da81e0b363ba0255b1be8d73609

SHA1
de2e7b558acb8975fc3960faf0c77c8e4d3e8248

SHA256
2b753bfce44db23ef5820f79edccf80843fb3c8fd7f2bd75862fe5db4d216f63

SHA512
a869b1dd517caf3470bde1406be0445ed37e9d2dca181fc0a6891134311136d577b9e6c62093a05c7f73d6d03314b9b0398e51044cff6524bdb83df9e117e239

Download Submit
C:\Users\Admin\AppData\Local\Temp\727ffb44-abd2-4331-9429-39c6a9c629c3.vbs

Filesize
719B

MD5
f13b04d1d340878123883c8605130072

SHA1
366d86133b4046f4657bcec15f48aa9d37b85511

SHA256
5ab5e9c82ec621013b00df072c9f445762869559c929641a4de93a6abe40ca4b

SHA512
dd38bad0d8fa29e3c6f6316ced1521b52995c16f6e4900684d7d92311351acbf1af64f540b557be1b2947b165cca60fb088e3c20d7c9da3d4f1267d6a98107ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_blochjtm.bv1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d91be530-a696-4d13-9a72-a07e9f6f4316.vbs

Filesize
719B

MD5
b79636067178a3bcfa85cb4edfd8f10d

SHA1
6d91f998ba93751807a7fa109dfd44cc708c2d82

SHA256
7036ace025d39d928ff1f965f58d92553b1fd216c3b7abd960c45630b05a50b8

SHA512
d4a7b5b9643005746d32cc99131538240f28b648cf9efebc302a7d6499f786d3c18bfbc9df3d3b87a248dd944d1a69a52361e87be31c2a213a09e9cc3dad974b

Download Submit
C:\Users\Admin\AppData\Local\Temp\d979c87e-6cb5-4c3e-ac93-9cb3b1906b1d.vbs

Filesize
719B

MD5
3d2386fdd9afcb229da8a8a5ff12d9c3

SHA1
e1c61c9d0df8c7d8bfa01817ffe1f26cf1d08577

SHA256
3605300d77c03b4acd0e8bd75cb629216deeece2bf53ecc66b1c1f40505965d9

SHA512
6b0b61925fd932c34a5565cf09ab2292934b89bc9305a5765cfe27b03c3e009633c1495bf2803a2134ae0b0378a3586a7de366b86f44720e5840de12327de340

Download Submit
C:\Users\Admin\AppData\Local\Temp\eef4a9f7-2468-45a1-8e91-89b8d21eafe4.vbs

Filesize
719B

MD5
177c14e7c4c3f6cc6969f95d58983f8b

SHA1
d331c8c32e18dd36761a2052f6e99643912575ea

SHA256
ad55814b722953f6a9906cbabdff07f25ac30b076025cdace31d23d0cb4bc04f

SHA512
7717a47ed179644b931d00276c61e19fc4da12454ad6144464d79b8a86c0b492564e730bf4d32e76c28b48b1fdf1ea885315f567f3331e31197c03852a1fb4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB8C4.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\uSm9iCqX6P.bat

Filesize
208B

MD5
72bd958b9c12dd8117f5891cc0106ff8

SHA1
2f06270905469e3fb256646df416b021183ea4c4

SHA256
a8bd8ce04060038bfb8445596d524783a06afe8fc0df9a034aeea3c78bc5636f

SHA512
6865b787fdd22de9040fe8df210abeb83306933a722e8c3b96c9ad41d8e481b876f1f3b9675cdae060e76efebbb4b897ccd1e00da51ef2856973fe919a996cc5

Download Submit
C:\Users\Default\sihost.exe

Filesize
4.9MB

MD5
d28c4dd72a0c3d67913bebc7f273e644

SHA1
f9a498456c3640a32070ed4167d582a66952330b

SHA256
42701fa1a448e7f6768976c8096319a403199ff8836da87c59f7cc5fcc711eed

SHA512
78e06b767bba41649db29017f6924c79d290d8e2832a1e4165bfef86f3fea6537e41b9c78d08c7f1d17c3efab836b3042fbb19f19e2b7680f0351bfbcc1523d9

Download Submit
memory/964-157-0x0000027252120000-0x0000027252142000-memory.dmp

Filesize
136KB

Download
memory/1900-10-0x0000000002C90000-0x0000000002C9A000-memory.dmp

Filesize
40KB

Download
memory/1900-4-0x0000000002C10000-0x0000000002C2C000-memory.dmp

Filesize
112KB

Download
memory/1900-8-0x0000000002C70000-0x0000000002C86000-memory.dmp

Filesize
88KB

Download
memory/1900-154-0x00007FFD8B300000-0x00007FFD8BDC1000-memory.dmp

Filesize
10.8MB

Download
memory/1900-9-0x0000000002C50000-0x0000000002C60000-memory.dmp

Filesize
64KB

Download
memory/1900-18-0x000000001B940000-0x000000001B94C000-memory.dmp

Filesize
48KB

Download
memory/1900-13-0x0000000002CB0000-0x0000000002CBA000-memory.dmp

Filesize
40KB

Download
memory/1900-7-0x0000000002C40000-0x0000000002C50000-memory.dmp

Filesize
64KB

Download
memory/1900-14-0x000000001B900000-0x000000001B90E000-memory.dmp

Filesize
56KB

Download
memory/1900-12-0x000000001C640000-0x000000001CB68000-memory.dmp

Filesize
5.2MB

Download
memory/1900-11-0x0000000002CA0000-0x0000000002CB2000-memory.dmp

Filesize
72KB

Download
memory/1900-16-0x000000001B920000-0x000000001B928000-memory.dmp

Filesize
32KB

Download
memory/1900-17-0x000000001B930000-0x000000001B938000-memory.dmp

Filesize
32KB

Download
memory/1900-1-0x00000000005E0000-0x0000000000AD4000-memory.dmp

Filesize
5.0MB

Download
memory/1900-15-0x000000001B910000-0x000000001B91E000-memory.dmp

Filesize
56KB

Download
memory/1900-6-0x0000000002C30000-0x0000000002C38000-memory.dmp

Filesize
32KB

Download
memory/1900-2-0x000000001B9E0000-0x000000001BB0E000-memory.dmp

Filesize
1.2MB

Download
memory/1900-5-0x0000000002CC0000-0x0000000002D10000-memory.dmp

Filesize
320KB

Download
memory/1900-3-0x00007FFD8B300000-0x00007FFD8BDC1000-memory.dmp

Filesize
10.8MB

Download
memory/1900-0-0x00007FFD8B303000-0x00007FFD8B305000-memory.dmp

Filesize
8KB

Download
memory/3208-331-0x000000001BE80000-0x000000001BE92000-memory.dmp

Filesize
72KB

Download
memory/4292-355-0x000000001B760000-0x000000001B772000-memory.dmp

Filesize
72KB

Download
memory/4308-483-0x000000001B940000-0x000000001B952000-memory.dmp

Filesize
72KB

Download
memory/4480-304-0x000000001BA50000-0x000000001BA62000-memory.dmp

Filesize
72KB

Download
memory/5092-85-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download