colibri | b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825b

Analysis

max time kernel
117s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Size

4.9MB
MD5

ad1d7de87e070b7b23fa84a82f1d6750
SHA1

07d20b4e486d420e7f55d397bfb35ed3f3d29870
SHA256

b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825b
SHA512

25bf7a13bba459a0b19d2445f99894745485eae060b4fc39f41c5dc62112b93ffc9b9f8679d0921fb1d7566153e0ac8c81d3082c7b63f5f2d141b820d1b8d4e4
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	1300	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	1300	schtasks.exe	82

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4188-3-0x000000001B5F0000-0x000000001B71E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3856	powershell.exe
2640	powershell.exe
4860	powershell.exe
1440	powershell.exe
2108	powershell.exe
2904	powershell.exe
4908	powershell.exe
1668	powershell.exe
3872	powershell.exe
5012	powershell.exe
3948	powershell.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 36 IoCs

pid	Process
3392	tmp8E68.tmp.exe
3512	tmp8E68.tmp.exe
1012	tmp8E68.tmp.exe
1276	tmp8E68.tmp.exe
2336	tmp8E68.tmp.exe
1100	RuntimeBroker.exe
2660	tmpBC3B.tmp.exe
1708	tmpBC3B.tmp.exe
3696	RuntimeBroker.exe
4184	tmpF01D.tmp.exe
3856	tmpF01D.tmp.exe
3080	tmpF01D.tmp.exe
1940	RuntimeBroker.exe
620	tmpCFB.tmp.exe
4548	tmpCFB.tmp.exe
3532	tmpCFB.tmp.exe
3428	RuntimeBroker.exe
4416	tmp3BDB.tmp.exe
2924	tmp3BDB.tmp.exe
2616	RuntimeBroker.exe
2088	tmp58E9.tmp.exe
3320	tmp58E9.tmp.exe
2844	RuntimeBroker.exe
3572	tmp8AD6.tmp.exe
648	tmp8AD6.tmp.exe
3356	tmp8AD6.tmp.exe
2900	RuntimeBroker.exe
2060	tmpBCB4.tmp.exe
3104	tmpBCB4.tmp.exe
2888	RuntimeBroker.exe
2616	tmpEC3F.tmp.exe
4292	tmpEC3F.tmp.exe
1264	RuntimeBroker.exe
2724	RuntimeBroker.exe
3396	tmp3956.tmp.exe
3900	tmp3956.tmp.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 2336	1276	tmp8E68.tmp.exe	130
PID 2660 set thread context of 1708	2660	tmpBC3B.tmp.exe	164
PID 3856 set thread context of 3080	3856	tmpF01D.tmp.exe	171
PID 4548 set thread context of 3532	4548	tmpCFB.tmp.exe	180
PID 4416 set thread context of 2924	4416	tmp3BDB.tmp.exe	186
PID 2088 set thread context of 3320	2088	tmp58E9.tmp.exe	192
PID 648 set thread context of 3356	648	tmp8AD6.tmp.exe	199
PID 2060 set thread context of 3104	2060	tmpBCB4.tmp.exe	205
PID 2616 set thread context of 4292	2616	tmpEC3F.tmp.exe	211
PID 3396 set thread context of 3900	3396	tmp3956.tmp.exe	220

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\sihost.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\RCXA8E1.tmp	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\SppExtComObj.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\RuntimeBroker.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Program Files (x86)\Google\Temp\Idle.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Program Files (x86)\Google\Temp\6ccacd8608530f	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\RCX906D.tmp	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\Idle.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX94A5.tmp	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\9e8d7a4ca61bd9	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\9e8d7a4ca61bd9	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX8E57.tmp	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\RuntimeBroker.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\66fc9ff0ee96c2	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\SppExtComObj.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\e1ef82546f0b02	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\RCX9281.tmp	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\sihost.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Provisioning\Packages\RCX993B.tmp	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Windows\Provisioning\Packages\services.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Windows\DiagTrack\Scenarios\RCXA6DC.tmp	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File opened for modification	C:\Windows\DiagTrack\Scenarios\smss.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Windows\Provisioning\Packages\services.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Windows\Provisioning\Packages\c5b4cb5e9653cc	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Windows\DiagTrack\Scenarios\smss.exe	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
File created	C:\Windows\DiagTrack\Scenarios\69ddcba757bf72	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCFB.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8AD6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8E68.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF01D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBC3B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp58E9.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpEC3F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3BDB.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8E68.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8E68.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF01D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCFB.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8AD6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBCB4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3956.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8E68.tmp.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
800	schtasks.exe
3148	schtasks.exe
3356	schtasks.exe
2428	schtasks.exe
2244	schtasks.exe
3988	schtasks.exe
4456	schtasks.exe
4588	schtasks.exe
3108	schtasks.exe
3004	schtasks.exe
3552	schtasks.exe
2132	schtasks.exe
5012	schtasks.exe
3596	schtasks.exe
740	schtasks.exe
1016	schtasks.exe
5056	schtasks.exe
4908	schtasks.exe
1668	schtasks.exe
3980	schtasks.exe
2056	schtasks.exe
3460	schtasks.exe
1556	schtasks.exe
3336	schtasks.exe
3984	schtasks.exe
3320	schtasks.exe
4200	schtasks.exe
3908	schtasks.exe
4696	schtasks.exe
1908	schtasks.exe
3856	schtasks.exe
1472	schtasks.exe
4080	schtasks.exe
1616	schtasks.exe
988	schtasks.exe
4560	schtasks.exe
2144	schtasks.exe
996	schtasks.exe
4768	schtasks.exe
3624	schtasks.exe
548	schtasks.exe
3688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
4908	powershell.exe
4908	powershell.exe
3856	powershell.exe
3856	powershell.exe
3948	powershell.exe
3948	powershell.exe
2108	powershell.exe
2108	powershell.exe
2640	powershell.exe
2640	powershell.exe
1668	powershell.exe
1668	powershell.exe
5012	powershell.exe
5012	powershell.exe
3872	powershell.exe
3872	powershell.exe
2904	powershell.exe
2904	powershell.exe
4860	powershell.exe
4860	powershell.exe
1440	powershell.exe
1440	powershell.exe
5012	powershell.exe
3948	powershell.exe
3856	powershell.exe
3856	powershell.exe
4908	powershell.exe
4908	powershell.exe
4860	powershell.exe
2640	powershell.exe
2640	powershell.exe
1668	powershell.exe
1668	powershell.exe
2108	powershell.exe
2108	powershell.exe
2904	powershell.exe
3872	powershell.exe
1440	powershell.exe
1100	RuntimeBroker.exe
1100	RuntimeBroker.exe
3696	RuntimeBroker.exe
1940	RuntimeBroker.exe
3428	RuntimeBroker.exe
2616	RuntimeBroker.exe
2844	RuntimeBroker.exe
2900	RuntimeBroker.exe
2888	RuntimeBroker.exe
1264	RuntimeBroker.exe
2724	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	1100	RuntimeBroker.exe
Token: SeDebugPrivilege	3696	RuntimeBroker.exe
Token: SeDebugPrivilege	1940	RuntimeBroker.exe
Token: SeDebugPrivilege	3428	RuntimeBroker.exe
Token: SeDebugPrivilege	2616	RuntimeBroker.exe
Token: SeDebugPrivilege	2844	RuntimeBroker.exe
Token: SeDebugPrivilege	2900	RuntimeBroker.exe
Token: SeDebugPrivilege	2888	RuntimeBroker.exe
Token: SeDebugPrivilege	1264	RuntimeBroker.exe
Token: SeDebugPrivilege	2724	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3392	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	125
PID 4188 wrote to memory of 3392	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	125
PID 4188 wrote to memory of 3392	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	125
PID 3392 wrote to memory of 3512	3392	tmp8E68.tmp.exe	127
PID 3392 wrote to memory of 3512	3392	tmp8E68.tmp.exe	127
PID 3392 wrote to memory of 3512	3392	tmp8E68.tmp.exe	127
PID 3512 wrote to memory of 1012	3512	tmp8E68.tmp.exe	128
PID 3512 wrote to memory of 1012	3512	tmp8E68.tmp.exe	128
PID 3512 wrote to memory of 1012	3512	tmp8E68.tmp.exe	128
PID 1012 wrote to memory of 1276	1012	tmp8E68.tmp.exe	129
PID 1012 wrote to memory of 1276	1012	tmp8E68.tmp.exe	129
PID 1012 wrote to memory of 1276	1012	tmp8E68.tmp.exe	129
PID 1276 wrote to memory of 2336	1276	tmp8E68.tmp.exe	130
PID 1276 wrote to memory of 2336	1276	tmp8E68.tmp.exe	130
PID 1276 wrote to memory of 2336	1276	tmp8E68.tmp.exe	130
PID 1276 wrote to memory of 2336	1276	tmp8E68.tmp.exe	130
PID 1276 wrote to memory of 2336	1276	tmp8E68.tmp.exe	130
PID 1276 wrote to memory of 2336	1276	tmp8E68.tmp.exe	130
PID 1276 wrote to memory of 2336	1276	tmp8E68.tmp.exe	130
PID 4188 wrote to memory of 1440	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	135
PID 4188 wrote to memory of 1440	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	135
PID 4188 wrote to memory of 3856	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	136
PID 4188 wrote to memory of 3856	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	136
PID 4188 wrote to memory of 3948	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	137
PID 4188 wrote to memory of 3948	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	137
PID 4188 wrote to memory of 4860	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	138
PID 4188 wrote to memory of 4860	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	138
PID 4188 wrote to memory of 4908	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	139
PID 4188 wrote to memory of 4908	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	139
PID 4188 wrote to memory of 2640	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	140
PID 4188 wrote to memory of 2640	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	140
PID 4188 wrote to memory of 2904	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	141
PID 4188 wrote to memory of 2904	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	141
PID 4188 wrote to memory of 2108	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	142
PID 4188 wrote to memory of 2108	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	142
PID 4188 wrote to memory of 5012	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	144
PID 4188 wrote to memory of 5012	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	144
PID 4188 wrote to memory of 1668	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	151
PID 4188 wrote to memory of 1668	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	151
PID 4188 wrote to memory of 3872	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	153
PID 4188 wrote to memory of 3872	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	153
PID 4188 wrote to memory of 1100	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	159
PID 4188 wrote to memory of 1100	4188	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe	159
PID 1100 wrote to memory of 1636	1100	RuntimeBroker.exe	160
PID 1100 wrote to memory of 1636	1100	RuntimeBroker.exe	160
PID 1100 wrote to memory of 960	1100	RuntimeBroker.exe	161
PID 1100 wrote to memory of 960	1100	RuntimeBroker.exe	161
PID 1100 wrote to memory of 2660	1100	RuntimeBroker.exe	162
PID 1100 wrote to memory of 2660	1100	RuntimeBroker.exe	162
PID 1100 wrote to memory of 2660	1100	RuntimeBroker.exe	162
PID 2660 wrote to memory of 1708	2660	tmpBC3B.tmp.exe	164
PID 2660 wrote to memory of 1708	2660	tmpBC3B.tmp.exe	164
PID 2660 wrote to memory of 1708	2660	tmpBC3B.tmp.exe	164
PID 2660 wrote to memory of 1708	2660	tmpBC3B.tmp.exe	164
PID 2660 wrote to memory of 1708	2660	tmpBC3B.tmp.exe	164
PID 2660 wrote to memory of 1708	2660	tmpBC3B.tmp.exe	164
PID 2660 wrote to memory of 1708	2660	tmpBC3B.tmp.exe	164
PID 1636 wrote to memory of 3696	1636	WScript.exe	165
PID 1636 wrote to memory of 3696	1636	WScript.exe	165
PID 3696 wrote to memory of 4964	3696	RuntimeBroker.exe	166
PID 3696 wrote to memory of 4964	3696	RuntimeBroker.exe	166
PID 3696 wrote to memory of 3820	3696	RuntimeBroker.exe	167
PID 3696 wrote to memory of 3820	3696	RuntimeBroker.exe	167
PID 3696 wrote to memory of 4184	3696	RuntimeBroker.exe	168

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe
"C:\Users\Admin\AppData\Local\Temp\b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825bN.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4188
- C:\Users\Admin\AppData\Local\Temp\tmp8E68.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8E68.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Users\Admin\AppData\Local\Temp\tmp8E68.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp8E68.tmp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\tmp8E68.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp8E68.tmp.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\tmp8E68.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8E68.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\tmp8E68.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8E68.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
  "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1100
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03971312-beb4-4527-8e27-d106674acc3e.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3696
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa50469d-e2b7-46a5-ad40-9243e204d4f7.vbs"
        5⤵
        
        PID:4964
      - C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d01292e-41da-485a-af53-445422ea4d74.vbs"
        7⤵
        
        PID:3664
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3428
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3564bc00-4773-46e3-9a13-4690ddb2a1ef.vbs"
        9⤵
        
        PID:5016
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2616
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5d08238-504d-4e30-992f-a61e92289734.vbs"
        11⤵
        
        PID:2288
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfdba306-f325-435d-a010-3d36b3a541df.vbs"
        13⤵
        
        PID:3316
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa95d185-584d-4668-b929-1ccb602b0103.vbs"
        15⤵
        
        PID:3772
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db617aa8-4dea-4bc8-9e5f-ecf4e24a722a.vbs"
        17⤵
        
        PID:3320
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\544d019d-c0b6-43f8-81ce-1b7b594af340.vbs"
        19⤵
        
        PID:2976
        
        C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9309319c-05bb-4df0-9d69-4e77e6c5ac99.vbs"
        21⤵
        
        PID:716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e0dcfc7-4a45-4a4f-ad66-90ecfc1f9d96.vbs"
        21⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\tmp3956.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3956.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\tmp3956.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3956.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:3900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0bb478ec-12f9-4128-88cb-5377364f6c1e.vbs"
        19⤵
        
        PID:4584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3f9585e0-73bc-4953-9ad2-19f71c98def4.vbs"
        17⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\tmpEC3F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEC3F.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\tmpEC3F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEC3F.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4ce21af-3a85-4543-bd83-b4687c928e6a.vbs"
        15⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\tmpBCB4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBCB4.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\tmpBCB4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBCB4.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12c595f1-6f6b-4062-ac17-ca7d85f33bcf.vbs"
        13⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\tmp8AD6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8AD6.tmp.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\tmp8AD6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8AD6.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\tmp8AD6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8AD6.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:3356
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a5bb33e-f6c0-485d-bdcf-3b8edc328d6a.vbs"
        11⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp58E9.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb1e2990-38bd-4d8f-b978-0a4ff51609d2.vbs"
        9⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\tmp3BDB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3BDB.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\tmp3BDB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3BDB.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94471997-2a8e-45a0-8215-25f77197525f.vbs"
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\tmpCFB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCFB.tmp.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\tmpCFB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCFB.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\tmpCFB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCFB.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:3532
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\700e0f2d-789e-4b48-a558-5881a75c5cce.vbs"
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\tmpF01D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF01D.tmp.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\tmpF01D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF01D.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\tmpF01D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF01D.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:3080
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70a168a3-6b95-4ab1-8970-a6f48dcf7bea.vbs"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\tmpBC3B.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpBC3B.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\tmpBC3B.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpBC3B.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Temp\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\Provisioning\Packages\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Provisioning\Packages\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\Provisioning\Packages\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Pictures\Camera Roll\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Camera Roll\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Pictures\Camera Roll\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\DiagTrack\Scenarios\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Scenarios\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\DiagTrack\Scenarios\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows NT\Accessories\en-US\sihost.exe

Filesize
4.9MB

MD5
ad1d7de87e070b7b23fa84a82f1d6750

SHA1
07d20b4e486d420e7f55d397bfb35ed3f3d29870

SHA256
b3a90d9e8f8fdeb4c68b82b47172de746edf24e28075965509231abc7d6a825b

SHA512
25bf7a13bba459a0b19d2445f99894745485eae060b4fc39f41c5dc62112b93ffc9b9f8679d0921fb1d7566153e0ac8c81d3082c7b63f5f2d141b820d1b8d4e4

Download Submit
C:\Recovery\WindowsRE\winlogon.exe

Filesize
4.9MB

MD5
59d56f2f65adab1611a507560c08a1f4

SHA1
c7a0937d146af7f3c51a533697b393192b5860c3

SHA256
f7d5006c79f92858285f258267e0640b7077f5c6da779ffe226dbb58ca912a82

SHA512
55b79c91bf45b4ea7967a5cbff8a0bb773da1384410f90f126b569bebd167b320254ad99c6c85772e9b2c69f572f489861bba82b3c439618f4d2d7c4912721c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\03971312-beb4-4527-8e27-d106674acc3e.vbs

Filesize
749B

MD5
5764945ec34fd5eb699ddd9b4cc0f68b

SHA1
80748584a7ccd8f08bebc8d0ccc1f48a16514012

SHA256
59444a62b95affbb4dbe918a07d15f356c04dc812200f082892f4d4475dbb6ef

SHA512
0f85461fd91d29ccd540a5191d7cbed69dcab789ce38bf33fe139f0ba51650c0c3d5805f1beee3f9261b85b7d93a1c1292eeeb727e237bd09ac9981c6f643623

Download Submit
C:\Users\Admin\AppData\Local\Temp\24ed40838b9f579435a6e745173fddd10a913c70.exe

Filesize
4.9MB

MD5
758a9fc022511ba59240c11fcb01d4c3

SHA1
546283619f4100f6719ec4bd21f2076858df8ee3

SHA256
a1348d60e855d14345363d2fd90b5167b25eba349c333894c65ec2e856b3c00a

SHA512
f20d83e33c9ae6f836be6ffb768681e2adafb70e4d8015a14be1f6eef0a782812da3bb428dd7cfeccb47a51e9b903ad5ff939a343e233c60b703e7fd56358b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\3564bc00-4773-46e3-9a13-4690ddb2a1ef.vbs

Filesize
749B

MD5
f0b991739850180a8e487dc647b5640d

SHA1
1df0528531e40d8f816f59c4014bdd8a0a4751aa

SHA256
13a9bb1d42d6a2735d8bc84d286464a42dbf99afe322871253de08260d679cb0

SHA512
3cb916ccafe8ffd74dbb767652951c58f1e277a4a58e54269c6aa60ae4d7079b045bd559366758c1602fbdd0b5015d752486ea964aec38d75b08cd0f3004bc51

Download Submit
C:\Users\Admin\AppData\Local\Temp\5d01292e-41da-485a-af53-445422ea4d74.vbs

Filesize
749B

MD5
14ccc86f782d8e1db1393da6a97994a6

SHA1
10e6710384ecf12dc4d1feca21cabb06b4644883

SHA256
c16187a2f33eaec758eadb1af8f25b12bbc5509e7ee76b92c7089cae0fab04d9

SHA512
f34245c79a7fc52afc67d4c1ef3cc822c3991e4c44900111e604a926da8d094a8ac846be1e67413ee210cb4eaeb566447f12fb22e74ff367198b7048b209ba28

Download Submit
C:\Users\Admin\AppData\Local\Temp\70a168a3-6b95-4ab1-8970-a6f48dcf7bea.vbs

Filesize
525B

MD5
cd91d61dd4094a8b29c8bc3a520178e5

SHA1
d025a15f691771fed7e9b5d2abdea8a9d6e59cc8

SHA256
54e1d0dfbd92c15b4ca5a65769378fee9aef5f58b48f97c07996375e277001a7

SHA512
cc83ac21c12ec603884818d4e9f1b10711248dc2c8e6c202bb581aa2acf4e7debefd812815a92df1f962c7376a2835f8c16ff14170cedaabc22c43a257ae7b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jubpe32m.14r.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5d08238-504d-4e30-992f-a61e92289734.vbs

Filesize
749B

MD5
569cfc9a18ece48bedc8ddb60012ff87

SHA1
b23fa8b8a767bb56518d9222818f7a914cef693c

SHA256
e13b8ba5e31a236e47295695ff8db138d9db3b8e0a8b487384f0a5d85ef15c1f

SHA512
0c3fe3475680ef749007be21d9365da711decf30d2e9e248ac91d98b29e354ce201452fb55576233a99fcdcae1ae59b410dfe7c0076cccd00232acf3b478ecea

Download Submit
C:\Users\Admin\AppData\Local\Temp\dfdba306-f325-435d-a010-3d36b3a541df.vbs

Filesize
749B

MD5
3c5dcb5b27412330bb36490d4402a169

SHA1
01f17d85bc00e6fa1aa4fc4b3b99972c7026924c

SHA256
67c241c8526ebb124ad1239df897165b8d3716e193dad921d8d33ce234a5ab44

SHA512
fb405fe90b74dac428bcf3ca1077a87ac04add3f033a0c0ad4f7649c8023dfb4e5272d21e4859eb7738dd21e332aa095d27a4c50e45bc2b795d4a704b27f31c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\fa50469d-e2b7-46a5-ad40-9243e204d4f7.vbs

Filesize
749B

MD5
650cce20f3abee99be85eee93ee13d4e

SHA1
58d5e2a084df9943dc05e405adb690811b8451e6

SHA256
f8bbd57dc57beae7dd23cc57b6b24428d2de10a2a6e646c929275a01f4db44c6

SHA512
52f606fde2500b757a9be0889ba97105f49f079f9b1ffc8145ca4076c35e88fad7c49bbd0469e3306205fa4e644080c6496c89bf2553a3e3ca68d2a60960b6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8E68.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
memory/1264-536-0x000000001DB80000-0x000000001DC82000-memory.dmp

Filesize
1.0MB

Download
memory/1264-528-0x000000001D7F0000-0x000000001D802000-memory.dmp

Filesize
72KB

Download
memory/2336-82-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2724-553-0x000000001DC30000-0x000000001DD32000-memory.dmp

Filesize
1.0MB

Download
memory/2844-492-0x000000001D670000-0x000000001D772000-memory.dmp

Filesize
1.0MB

Download
memory/2888-527-0x000000001D6F0000-0x000000001D7F2000-memory.dmp

Filesize
1.0MB

Download
memory/2900-510-0x000000001D300000-0x000000001D402000-memory.dmp

Filesize
1.0MB

Download
memory/3856-224-0x0000021CF9870000-0x0000021CF9892000-memory.dmp

Filesize
136KB

Download
memory/4188-12-0x000000001C300000-0x000000001C828000-memory.dmp

Filesize
5.2MB

Download
memory/4188-321-0x00007FFDD28E0000-0x00007FFDD33A1000-memory.dmp

Filesize
10.8MB

Download
memory/4188-160-0x00007FFDD28E0000-0x00007FFDD33A1000-memory.dmp

Filesize
10.8MB

Download
memory/4188-145-0x00007FFDD28E3000-0x00007FFDD28E5000-memory.dmp

Filesize
8KB

Download
memory/4188-18-0x000000001BDE0000-0x000000001BDEC000-memory.dmp

Filesize
48KB

Download
memory/4188-16-0x000000001B760000-0x000000001B768000-memory.dmp

Filesize
32KB

Download
memory/4188-17-0x000000001BDD0000-0x000000001BDD8000-memory.dmp

Filesize
32KB

Download
memory/4188-13-0x000000001B730000-0x000000001B73A000-memory.dmp

Filesize
40KB

Download
memory/4188-14-0x000000001B740000-0x000000001B74E000-memory.dmp

Filesize
56KB

Download
memory/4188-15-0x000000001B750000-0x000000001B75E000-memory.dmp

Filesize
56KB

Download
memory/4188-0-0x00007FFDD28E3000-0x00007FFDD28E5000-memory.dmp

Filesize
8KB

Download
memory/4188-11-0x000000001B720000-0x000000001B732000-memory.dmp

Filesize
72KB

Download
memory/4188-6-0x0000000001040000-0x0000000001048000-memory.dmp

Filesize
32KB

Download
memory/4188-10-0x000000001B4D0000-0x000000001B4DA000-memory.dmp

Filesize
40KB

Download
memory/4188-9-0x0000000001070000-0x0000000001080000-memory.dmp

Filesize
64KB

Download
memory/4188-8-0x000000001B4B0000-0x000000001B4C6000-memory.dmp

Filesize
88KB

Download
memory/4188-7-0x0000000001060000-0x0000000001070000-memory.dmp

Filesize
64KB

Download
memory/4188-5-0x000000001BD80000-0x000000001BDD0000-memory.dmp

Filesize
320KB

Download
memory/4188-4-0x0000000001010000-0x000000000102C000-memory.dmp

Filesize
112KB

Download
memory/4188-2-0x00007FFDD28E0000-0x00007FFDD33A1000-memory.dmp

Filesize
10.8MB

Download
memory/4188-3-0x000000001B5F0000-0x000000001B71E000-memory.dmp

Filesize
1.2MB

Download
memory/4188-1-0x0000000000330000-0x0000000000824000-memory.dmp

Filesize
5.0MB

Download