27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c

Analysis

max time kernel
119s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Size

1.9MB
MD5

00db28e5a7412cf4a6f87f8589244cd1
SHA1

49a8344dac9b27ebe4962f4fce5c7e2ef9c023f7
SHA256

27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c
SHA512

3c860c48ae7f37b023299455830310390c14ad69fa1e241e9f94041b9797ca415841c4b541b105b6ac84327015a97b1664aa098d3f2f4d918341e2dca65d60ba
SSDEEP

24576:mX7tyazXp4qrSJZHJTEyMkbjla5TA3fmpKuUJBU8uQgyfg29H4EG7FhfESrpBrmi:mqR1a5T+fvmr0p4BDfzjmIADb

Score

10^/10

credential_access discovery execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\fr-FR\\lsm.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\fr-FR\\lsm.exe\", \"C:\\Program Files (x86)\\Windows Mail\\System.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\fr-FR\\lsm.exe\", \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\fr-FR\\lsm.exe\", \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\", \"C:\\Users\\Public\\Libraries\\csrss.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\fr-FR\\lsm.exe\", \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\", \"C:\\Users\\Public\\Libraries\\csrss.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	1056	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	1056	schtasks.exe	30

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1988	powershell.exe
884	powershell.exe
1600	powershell.exe
1368	powershell.exe
1076	powershell.exe
828	powershell.exe
1852	powershell.exe
2104	powershell.exe
2508	powershell.exe
2064	powershell.exe
1716	powershell.exe
2896	powershell.exe
1972	powershell.exe
2656	powershell.exe
2988	powershell.exe
1512	powershell.exe
1488	powershell.exe
3064	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1616	csrss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\Libraries\\csrss.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\fr-FR\\lsm.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows Mail\\System.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\Libraries\\csrss.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\fr-FR\\lsm.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows Mail\\System.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe\""	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\qmeprf.exe	csc.exe
File created	\??\c:\Windows\System32\CSC4F3717C7D500443BA8D9544C9E562C3A.TMP	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\System.exe	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
File created	C:\Program Files (x86)\Windows Mail\27d1bcfc3c54e0	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\lsm.exe	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\101b941d020240	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1748	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1748	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1248	schtasks.exe
1276	schtasks.exe
992	schtasks.exe
1288	schtasks.exe
2948	schtasks.exe
2456	schtasks.exe
1728	schtasks.exe
2344	schtasks.exe
2136	schtasks.exe
2604	schtasks.exe
2076	schtasks.exe
304	schtasks.exe
2328	schtasks.exe
1752	schtasks.exe
2868	schtasks.exe
2844	schtasks.exe
1708	schtasks.exe
536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	828	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	1616	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1484	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	34
PID 2364 wrote to memory of 1484	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	34
PID 2364 wrote to memory of 1484	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	34
PID 1484 wrote to memory of 1456	1484	csc.exe	36
PID 1484 wrote to memory of 1456	1484	csc.exe	36
PID 1484 wrote to memory of 1456	1484	csc.exe	36
PID 2364 wrote to memory of 1716	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	52
PID 2364 wrote to memory of 1716	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	52
PID 2364 wrote to memory of 1716	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	52
PID 2364 wrote to memory of 2064	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	53
PID 2364 wrote to memory of 2064	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	53
PID 2364 wrote to memory of 2064	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	53
PID 2364 wrote to memory of 3064	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	54
PID 2364 wrote to memory of 3064	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	54
PID 2364 wrote to memory of 3064	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	54
PID 2364 wrote to memory of 1488	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	56
PID 2364 wrote to memory of 1488	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	56
PID 2364 wrote to memory of 1488	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	56
PID 2364 wrote to memory of 1076	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	58
PID 2364 wrote to memory of 1076	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	58
PID 2364 wrote to memory of 1076	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	58
PID 2364 wrote to memory of 1512	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	59
PID 2364 wrote to memory of 1512	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	59
PID 2364 wrote to memory of 1512	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	59
PID 2364 wrote to memory of 2988	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	61
PID 2364 wrote to memory of 2988	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	61
PID 2364 wrote to memory of 2988	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	61
PID 2364 wrote to memory of 2656	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	63
PID 2364 wrote to memory of 2656	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	63
PID 2364 wrote to memory of 2656	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	63
PID 2364 wrote to memory of 1972	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	64
PID 2364 wrote to memory of 1972	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	64
PID 2364 wrote to memory of 1972	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	64
PID 2364 wrote to memory of 1988	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	66
PID 2364 wrote to memory of 1988	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	66
PID 2364 wrote to memory of 1988	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	66
PID 2364 wrote to memory of 2896	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	67
PID 2364 wrote to memory of 2896	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	67
PID 2364 wrote to memory of 2896	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	67
PID 2364 wrote to memory of 1368	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	68
PID 2364 wrote to memory of 1368	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	68
PID 2364 wrote to memory of 1368	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	68
PID 2364 wrote to memory of 1600	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	69
PID 2364 wrote to memory of 1600	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	69
PID 2364 wrote to memory of 1600	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	69
PID 2364 wrote to memory of 828	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	70
PID 2364 wrote to memory of 828	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	70
PID 2364 wrote to memory of 828	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	70
PID 2364 wrote to memory of 2508	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	71
PID 2364 wrote to memory of 2508	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	71
PID 2364 wrote to memory of 2508	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	71
PID 2364 wrote to memory of 2104	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	73
PID 2364 wrote to memory of 2104	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	73
PID 2364 wrote to memory of 2104	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	73
PID 2364 wrote to memory of 1852	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	74
PID 2364 wrote to memory of 1852	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	74
PID 2364 wrote to memory of 1852	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	74
PID 2364 wrote to memory of 884	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	76
PID 2364 wrote to memory of 884	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	76
PID 2364 wrote to memory of 884	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	76
PID 2364 wrote to memory of 1700	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	83
PID 2364 wrote to memory of 1700	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	83
PID 2364 wrote to memory of 1700	2364	27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe	83
PID 1700 wrote to memory of 2456	1700	cmd.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe
"C:\Users\Admin\AppData\Local\Temp\27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fnooxvdd\fnooxvdd.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A16.tmp" "c:\Windows\System32\CSC4F3717C7D500443BA8D9544C9E562C3A.TMP"
    3⤵
    PID:1456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zETqYlcEzC.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2456
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1748
- - C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe
    "C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Libraries\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c2" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c2" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe

Filesize
1.9MB

MD5
00db28e5a7412cf4a6f87f8589244cd1

SHA1
49a8344dac9b27ebe4962f4fce5c7e2ef9c023f7

SHA256
27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c

SHA512
3c860c48ae7f37b023299455830310390c14ad69fa1e241e9f94041b9797ca415841c4b541b105b6ac84327015a97b1664aa098d3f2f4d918341e2dca65d60ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1A16.tmp

Filesize
1KB

MD5
695aa4034e0250cf4710ef705e6d475d

SHA1
aae3e43e0a94ed934dadea27d6dfee3de3040d73

SHA256
d0f0e7335263b5346aa8e9bf062896949652d8ce427b90ba1933c9041b97f49e

SHA512
54c4a7630fea9bd42d081fd2c01e853b20bf07b679fbb55e62048a07f64cb75e553e3835c095c6fb93c0e8f17b6912300ba1f6538a454ff28f1c3d7f36e8d5a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\zETqYlcEzC.bat

Filesize
186B

MD5
aca0fe27bb6bb4ed571085a7bb143d4c

SHA1
aa59dbfbd5a8f6b6d50387d330b937c2282c8bf6

SHA256
b465d1d1968dce72798683111e7ac1eba2e3323102d0dc8b7beac89fe5043ada

SHA512
7f2a120d558721b5d53bbc97a7bd4da78764792fdd3d5873f342f598e28dc234717b62e028752888fce4b6fa7144750695a2af5a0e446cb4f6b69c59045ae316

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e9d1a1bf980f5b50a67dc054effd7664

SHA1
5e862e4f421105039ebfce1af1a2922c0fd46871

SHA256
0f1289e4259d39934f46a36f8f276b451a47330886acc347c4c69f3ceca18525

SHA512
388398bb5d97b3338285a9d31ab29f774e2f767a3a604e52f7e9aa22f9540bb531d9624817067b48ba8c2946033b2740d0b87443fb44a6abc0777963f41d848b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fnooxvdd\fnooxvdd.0.cs

Filesize
407B

MD5
a61a0b4b99aec54294e9a07e8c7466da

SHA1
e0e3784e88ffaf6c577b9a9041dc99fbcaaf07e8

SHA256
0c265d72580d7a0ec06c673bda3c4ae3e5e547b032a02283e1269b9e1a10478e

SHA512
06a32c4b9a1c25fd1aa285a148d03b80ed4f790965c8b11d676fbf56a3abb348be26fd7b982e8584126896addf37617484a9c8221acbf8fc9bc45e9cc71af3a9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fnooxvdd\fnooxvdd.cmdline

Filesize
235B

MD5
545b5f2e4383d1d0d1c577f179cba3b7

SHA1
068fc97a64387ca080c2e490b3f392533a9afd18

SHA256
2264030031c4cb1fd50a07f4e3fbcf5217491bba9f5b83bc00c86cee102ab009

SHA512
b8e165eaa6b82c7128d61b9a03db0a75e94e9a153f00fa97eccf3430d3152b13f38e55706fba7307a9e60488dcc6048fdd0161b43d9cd6d8c12a55b1d422974d

Download Submit
\??\c:\Windows\System32\CSC4F3717C7D500443BA8D9544C9E562C3A.TMP

Filesize
1KB

MD5
167c870490dc33ec13a83ebb533b1bf6

SHA1
182378ebfa7c8372a988dee50a7dd6f8cda6a367

SHA256
3f742a374ad5a8da8fba9dfea27c7382dde145d46732cfc0002a53a1311df5e6

SHA512
1b48bb5f270f5d99d9dd98cd9da5866aed9377957d92bf1d686878522c438b38a444073c1a0ed4cc85f97315d2ef6abf05b74ab2265fecb20be5795b2ccef64e

Download Submit
memory/1616-121-0x0000000000EA0000-0x000000000109A000-memory.dmp

Filesize
2.0MB

Download
memory/1716-67-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/1716-68-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2364-9-0x0000000000B50000-0x0000000000B6C000-memory.dmp

Filesize
112KB

Download
memory/2364-13-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-21-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-20-0x0000000000D20000-0x0000000000D2E000-memory.dmp

Filesize
56KB

Download
memory/2364-24-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-25-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-18-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-17-0x0000000000630000-0x000000000063C000-memory.dmp

Filesize
48KB

Download
memory/2364-15-0x0000000000620000-0x000000000062E000-memory.dmp

Filesize
56KB

Download
memory/2364-23-0x0000000000D30000-0x0000000000D3C000-memory.dmp

Filesize
48KB

Download
memory/2364-12-0x0000000000D00000-0x0000000000D18000-memory.dmp

Filesize
96KB

Download
memory/2364-10-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-0-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

Filesize
4KB

Download
memory/2364-7-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-6-0x0000000000610000-0x000000000061E000-memory.dmp

Filesize
56KB

Download
memory/2364-86-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-4-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-3-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-2-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-1-0x0000000001170000-0x000000000136A000-memory.dmp

Filesize
2.0MB

Download