colibri | 9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01

Analysis

max time kernel
118s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Size

4.9MB
MD5

e2241d87a05eba7625bd361348192770
SHA1

281b897777f56ef0d19d2d1ac01a8ccf192e6aaf
SHA256

9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01
SHA512

0d040357739485e57462e6ca307816f0e661f8329e31b533c750e027a5668376c1a2175630d22fd7f2db27ff8cf21377a8dfed55e59c986d762e804e2267536e
SSDEEP

49152:Ll5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3412	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	1160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	1160	schtasks.exe	82

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3864-3-0x000000001B5E0000-0x000000001B70E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
608	powershell.exe
2604	powershell.exe
2496	powershell.exe
3936	powershell.exe
4768	powershell.exe
4996	powershell.exe
4740	powershell.exe
2912	powershell.exe
3028	powershell.exe
4992	powershell.exe
4944	powershell.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 39 IoCs

pid	Process
4332	tmp8531.tmp.exe
1364	tmp8531.tmp.exe
3204	tmp8531.tmp.exe
4072	RuntimeBroker.exe
4844	tmpBAC4.tmp.exe
3972	tmpBAC4.tmp.exe
3548	tmpBAC4.tmp.exe
4116	RuntimeBroker.exe
4836	tmpF2CC.tmp.exe
3724	tmpF2CC.tmp.exe
2168	RuntimeBroker.exe
3400	tmp248A.tmp.exe
952	tmp248A.tmp.exe
2272	tmp248A.tmp.exe
4380	RuntimeBroker.exe
3888	tmp405F.tmp.exe
4140	tmp405F.tmp.exe
572	RuntimeBroker.exe
1396	tmp5D6D.tmp.exe
220	tmp5D6D.tmp.exe
4672	RuntimeBroker.exe
3656	tmp8E12.tmp.exe
4724	tmp8E12.tmp.exe
552	tmp8E12.tmp.exe
4260	RuntimeBroker.exe
3748	tmpAB10.tmp.exe
936	tmpAB10.tmp.exe
4732	RuntimeBroker.exe
3696	tmpDB28.tmp.exe
3560	tmpDB28.tmp.exe
4964	RuntimeBroker.exe
4324	tmpBAE.tmp.exe
3024	tmpBAE.tmp.exe
2956	RuntimeBroker.exe
4844	tmp2754.tmp.exe
1140	tmp2754.tmp.exe
1592	RuntimeBroker.exe
2708	tmp4378.tmp.exe
4556	tmp4378.tmp.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 1364 set thread context of 3204	1364	tmp8531.tmp.exe	137
PID 3972 set thread context of 3548	3972	tmpBAC4.tmp.exe	170
PID 4836 set thread context of 3724	4836	tmpF2CC.tmp.exe	179
PID 952 set thread context of 2272	952	tmp248A.tmp.exe	187
PID 3888 set thread context of 4140	3888	tmp405F.tmp.exe	193
PID 1396 set thread context of 220	1396	tmp5D6D.tmp.exe	199
PID 4724 set thread context of 552	4724	tmp8E12.tmp.exe	206
PID 3748 set thread context of 936	3748	tmpAB10.tmp.exe	212
PID 3696 set thread context of 3560	3696	tmpDB28.tmp.exe	218
PID 4324 set thread context of 3024	4324	tmpBAE.tmp.exe	224
PID 4844 set thread context of 1140	4844	tmp2754.tmp.exe	230
PID 2708 set thread context of 4556	2708	tmp4378.tmp.exe	236

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCX8AA2.tmp	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files\Google\Chrome\9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files\Windows Mail\explorer.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXA5D7.tmp	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\fontdrvhost.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files\Windows Defender\explorer.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files\Windows Defender\7a0fd90576e088	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files\Google\Chrome\RCXA141.tmp	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files\Google\Chrome\99fa9d02840f62	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\5b884080fd4f94	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\SIGNUP\RCX83E7.tmp	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX85FD.tmp	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files\Windows Defender\explorer.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\0a1fd5f707cd16	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files\Windows Mail\7a0fd90576e088	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX9EC0.tmp	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\9e8d7a4ca61bd9	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files\Google\Chrome\9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files\Windows Mail\explorer.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\fontdrvhost.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files\Windows Mail\RCXA356.tmp	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\9e8d7a4ca61bd9	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files\Windows Defender\RCX95E2.tmp	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\DigitalLocker\f3b6ecef712a24	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Windows\DigitalLocker\RCX9A88.tmp	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File opened for modification	C:\Windows\DigitalLocker\spoolsv.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
File created	C:\Windows\DigitalLocker\spoolsv.exe	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2754.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4378.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp248A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5D6D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8E12.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8531.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBAC4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBAE.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBAC4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp248A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDB28.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8E12.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAB10.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8531.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF2CC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp405F.tmp.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2844	schtasks.exe
4436	schtasks.exe
4828	schtasks.exe
4872	schtasks.exe
1004	schtasks.exe
952	schtasks.exe
3884	schtasks.exe
3888	schtasks.exe
2656	schtasks.exe
2336	schtasks.exe
2020	schtasks.exe
4184	schtasks.exe
2676	schtasks.exe
2500	schtasks.exe
3440	schtasks.exe
1668	schtasks.exe
3532	schtasks.exe
5036	schtasks.exe
1164	schtasks.exe
4604	schtasks.exe
224	schtasks.exe
1480	schtasks.exe
3412	schtasks.exe
1488	schtasks.exe
2928	schtasks.exe
4904	schtasks.exe
3028	schtasks.exe
2952	schtasks.exe
4028	schtasks.exe
3100	schtasks.exe
2604	schtasks.exe
2956	schtasks.exe
2724	schtasks.exe
960	schtasks.exe
2564	schtasks.exe
3848	schtasks.exe
3576	schtasks.exe
2508	schtasks.exe
2568	schtasks.exe
4800	schtasks.exe
3228	schtasks.exe
1332	schtasks.exe
2092	schtasks.exe
1624	schtasks.exe
436	schtasks.exe
1244	schtasks.exe
2332	schtasks.exe
1216	schtasks.exe
3720	schtasks.exe
4984	schtasks.exe
5032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
2496	powershell.exe
2496	powershell.exe
4944	powershell.exe
4944	powershell.exe
3936	powershell.exe
3936	powershell.exe
3028	powershell.exe
3028	powershell.exe
4768	powershell.exe
4768	powershell.exe
2912	powershell.exe
2912	powershell.exe
608	powershell.exe
608	powershell.exe
4740	powershell.exe
4740	powershell.exe
4996	powershell.exe
4996	powershell.exe
4992	powershell.exe
4992	powershell.exe
2604	powershell.exe
2604	powershell.exe
2496	powershell.exe
4944	powershell.exe
3936	powershell.exe
4768	powershell.exe
3028	powershell.exe
2912	powershell.exe
608	powershell.exe
4740	powershell.exe
4992	powershell.exe
4996	powershell.exe
2604	powershell.exe
4072	RuntimeBroker.exe
4072	RuntimeBroker.exe
4116	RuntimeBroker.exe
2168	RuntimeBroker.exe
4380	RuntimeBroker.exe
572	RuntimeBroker.exe
4672	RuntimeBroker.exe
4260	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	608	powershell.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	4072	RuntimeBroker.exe
Token: SeDebugPrivilege	4116	RuntimeBroker.exe
Token: SeDebugPrivilege	2168	RuntimeBroker.exe
Token: SeDebugPrivilege	4380	RuntimeBroker.exe
Token: SeDebugPrivilege	572	RuntimeBroker.exe
Token: SeDebugPrivilege	4672	RuntimeBroker.exe
Token: SeDebugPrivilege	4260	RuntimeBroker.exe
Token: SeDebugPrivilege	4732	RuntimeBroker.exe
Token: SeDebugPrivilege	4964	RuntimeBroker.exe
Token: SeDebugPrivilege	2956	RuntimeBroker.exe
Token: SeDebugPrivilege	1592	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 4332	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	134
PID 3864 wrote to memory of 4332	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	134
PID 3864 wrote to memory of 4332	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	134
PID 4332 wrote to memory of 1364	4332	tmp8531.tmp.exe	136
PID 4332 wrote to memory of 1364	4332	tmp8531.tmp.exe	136
PID 4332 wrote to memory of 1364	4332	tmp8531.tmp.exe	136
PID 1364 wrote to memory of 3204	1364	tmp8531.tmp.exe	137
PID 1364 wrote to memory of 3204	1364	tmp8531.tmp.exe	137
PID 1364 wrote to memory of 3204	1364	tmp8531.tmp.exe	137
PID 1364 wrote to memory of 3204	1364	tmp8531.tmp.exe	137
PID 1364 wrote to memory of 3204	1364	tmp8531.tmp.exe	137
PID 1364 wrote to memory of 3204	1364	tmp8531.tmp.exe	137
PID 1364 wrote to memory of 3204	1364	tmp8531.tmp.exe	137
PID 3864 wrote to memory of 2604	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	141
PID 3864 wrote to memory of 2604	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	141
PID 3864 wrote to memory of 2496	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	142
PID 3864 wrote to memory of 2496	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	142
PID 3864 wrote to memory of 3936	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	143
PID 3864 wrote to memory of 3936	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	143
PID 3864 wrote to memory of 4740	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	145
PID 3864 wrote to memory of 4740	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	145
PID 3864 wrote to memory of 608	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	146
PID 3864 wrote to memory of 608	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	146
PID 3864 wrote to memory of 4944	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	147
PID 3864 wrote to memory of 4944	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	147
PID 3864 wrote to memory of 4992	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	148
PID 3864 wrote to memory of 4992	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	148
PID 3864 wrote to memory of 4996	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	149
PID 3864 wrote to memory of 4996	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	149
PID 3864 wrote to memory of 3028	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	150
PID 3864 wrote to memory of 3028	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	150
PID 3864 wrote to memory of 2912	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	151
PID 3864 wrote to memory of 2912	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	151
PID 3864 wrote to memory of 4768	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	152
PID 3864 wrote to memory of 4768	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	152
PID 3864 wrote to memory of 4072	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	164
PID 3864 wrote to memory of 4072	3864	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe	164
PID 4072 wrote to memory of 4844	4072	RuntimeBroker.exe	167
PID 4072 wrote to memory of 4844	4072	RuntimeBroker.exe	167
PID 4072 wrote to memory of 4844	4072	RuntimeBroker.exe	167
PID 4844 wrote to memory of 3972	4844	tmpBAC4.tmp.exe	169
PID 4844 wrote to memory of 3972	4844	tmpBAC4.tmp.exe	169
PID 4844 wrote to memory of 3972	4844	tmpBAC4.tmp.exe	169
PID 3972 wrote to memory of 3548	3972	tmpBAC4.tmp.exe	170
PID 3972 wrote to memory of 3548	3972	tmpBAC4.tmp.exe	170
PID 3972 wrote to memory of 3548	3972	tmpBAC4.tmp.exe	170
PID 3972 wrote to memory of 3548	3972	tmpBAC4.tmp.exe	170
PID 3972 wrote to memory of 3548	3972	tmpBAC4.tmp.exe	170
PID 3972 wrote to memory of 3548	3972	tmpBAC4.tmp.exe	170
PID 3972 wrote to memory of 3548	3972	tmpBAC4.tmp.exe	170
PID 4072 wrote to memory of 3180	4072	RuntimeBroker.exe	171
PID 4072 wrote to memory of 3180	4072	RuntimeBroker.exe	171
PID 4072 wrote to memory of 1820	4072	RuntimeBroker.exe	172
PID 4072 wrote to memory of 1820	4072	RuntimeBroker.exe	172
PID 3180 wrote to memory of 4116	3180	WScript.exe	173
PID 3180 wrote to memory of 4116	3180	WScript.exe	173
PID 4116 wrote to memory of 1884	4116	RuntimeBroker.exe	175
PID 4116 wrote to memory of 1884	4116	RuntimeBroker.exe	175
PID 4116 wrote to memory of 2832	4116	RuntimeBroker.exe	176
PID 4116 wrote to memory of 2832	4116	RuntimeBroker.exe	176
PID 4116 wrote to memory of 4836	4116	RuntimeBroker.exe	177
PID 4116 wrote to memory of 4836	4116	RuntimeBroker.exe	177
PID 4116 wrote to memory of 4836	4116	RuntimeBroker.exe	177
PID 4836 wrote to memory of 3724	4836	tmpF2CC.tmp.exe	179

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe
"C:\Users\Admin\AppData\Local\Temp\9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3864
- C:\Users\Admin\AppData\Local\Temp\tmp8531.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8531.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Users\Admin\AppData\Local\Temp\tmp8531.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp8531.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\tmp8531.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp8531.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:3204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4072
- - C:\Users\Admin\AppData\Local\Temp\tmpBAC4.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpBAC4.tmp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\tmpBAC4.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpBAC4.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\tmpBAC4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBAC4.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:3548
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c2e8cd62-b1ec-4068-96b8-cfed3af3139e.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4116
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bcbc62a2-a21e-4125-9d56-1d2b01a3fe81.vbs"
        5⤵
        
        PID:1884
      - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2168
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75306b8d-6277-4999-9e7a-a9e2a9188cc2.vbs"
        7⤵
        
        PID:1208
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d92ec61a-3f1d-44a8-bf82-70255598c048.vbs"
        9⤵
        
        PID:2288
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfacacd4-fcf7-40d6-a275-c3275fcb313b.vbs"
        11⤵
        
        PID:1684
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c06e6dd-9a62-4615-8d8d-481078bb488d.vbs"
        13⤵
        
        PID:560
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11a2d9bb-83bb-4b26-810c-789b7843f30b.vbs"
        15⤵
        
        PID:3292
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4eafa9a-45b0-47ee-a508-c5618f252536.vbs"
        17⤵
        
        PID:3200
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91dfc109-d3fb-42a2-8861-c21142dc4404.vbs"
        19⤵
        
        PID:5044
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32111e73-588b-408d-9c58-84725c08645f.vbs"
        21⤵
        
        PID:3460
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe"
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bdd0c9a-d39b-493d-90c5-8914adfe9775.vbs"
        23⤵
        
        PID:3380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c665edf1-81ae-42fa-a3ba-4f167e329ccb.vbs"
        23⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\tmp4378.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4378.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\tmp4378.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4378.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47b70af0-288d-4aaa-8f42-2cb214735116.vbs"
        21⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\tmp2754.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2754.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\tmp2754.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2754.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c65099d-be91-468b-9370-c7d0d551df70.vbs"
        19⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\tmpBAE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBAE.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\tmpBAE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBAE.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82e437dc-7410-421b-a27a-a83b5c055446.vbs"
        17⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\tmpDB28.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDB28.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\tmpDB28.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDB28.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:3560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71c052b4-f5bc-4c3e-ac0a-7b57e60bb775.vbs"
        15⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\tmpAB10.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAB10.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\tmpAB10.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAB10.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4f6815c-5822-401c-ab44-42ad93e35c1c.vbs"
        13⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\tmp8E12.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8E12.tmp.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\tmp8E12.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8E12.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\tmp8E12.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8E12.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a05b1d2-84cf-49ee-8041-785487cb5389.vbs"
        11⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\tmp5D6D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5D6D.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\tmp5D6D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5D6D.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d88e4c5a-bc86-4ed8-a0fe-e6ccf2981c9e.vbs"
        9⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\tmp405F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp405F.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\tmp405F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp405F.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:4140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1998e2a4-114c-4765-89b8-c3456ee10125.vbs"
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\tmp248A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp248A.tmp.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\tmp248A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp248A.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\tmp248A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp248A.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:2272
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57b08d67-9e3c-4099-852c-641af7d2a228.vbs"
        5⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\tmpF2CC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF2CC.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\tmpF2CC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF2CC.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:3724
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5bcf2f2a-d7c9-4502-9f84-008f360a0d03.vbs"
    3⤵
    PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Saved Games\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Saved Games\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Packages\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\Packages\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Packages\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\DigitalLocker\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\All Users\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N9" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N9" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe

Filesize
4.9MB

MD5
11f3fc51a5643195d590419a563374fa

SHA1
e09c691388de5f8568d6baf1e5655d222f2088af

SHA256
2feae7c8f179053cce055679e4c1b90be0e00ec8ecd82503e21954fe704fa158

SHA512
fa5244914af1ff7ca81ad25150e8345ac2509df2ad102839dddc28c77ed3c233090acdbe94b8a9d3f124015e577affe7977cd46fe99d4d7920032f871c6f8dc6

Download Submit
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe

Filesize
4.9MB

MD5
e2241d87a05eba7625bd361348192770

SHA1
281b897777f56ef0d19d2d1ac01a8ccf192e6aaf

SHA256
9a55fe0eab70afff8306d479da0f5420f11b00916bca6c51a73c1423a6df1b01

SHA512
0d040357739485e57462e6ca307816f0e661f8329e31b533c750e027a5668376c1a2175630d22fd7f2db27ff8cf21377a8dfed55e59c986d762e804e2267536e

Download Submit
C:\Program Files\Windows Mail\explorer.exe

Filesize
4.9MB

MD5
779f6136be2f68a1999c542c705f4d2b

SHA1
9fd94a39683dc647840b455714032da894d9d9d4

SHA256
4807356dd2619b315daa1864b32fc7810850b9f3908bb07953fa4cc4e8986722

SHA512
bbbafa69928806b12dfbce67c51bdecd790887da1c65644b443a3cf8cf0a5b927762a2dc9f2dd53fdac7aaac646ce8e1fdcba02cc89dc55f5a12c655549d4372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\0c06e6dd-9a62-4615-8d8d-481078bb488d.vbs

Filesize
740B

MD5
11206e066ae7ae19fd30f89c9d11ff77

SHA1
2364f5cef2a3d707ac4b428c6205af6300f1df34

SHA256
ffba6c6c8a9a78346dab117902c6c9d20df16db77255e073f4b7b5920900d898

SHA512
b8e213aa99ab5dcbcbb0dad83bed4d2b53e2c33b7b3dbceb9b4d1c0534397ab3a1fefa8d35b5141e52f37347aa6f31bffe6c69bf69755e935ec7b9fc41d44057

Download Submit
C:\Users\Admin\AppData\Local\Temp\11a2d9bb-83bb-4b26-810c-789b7843f30b.vbs

Filesize
740B

MD5
ed0def6b4b2f3e0d35bb283037985869

SHA1
b69a1389fb61504780c2c14e2136359fc48da6ce

SHA256
268ea65972f785881e4d93c6a69b6299c933bf4e872ca2ef9df2d7660d8615bc

SHA512
732474067cbf456a2e6970ef36857d2ddd5e83f7e2d560a43c7665ce9d350afc0cdd210a3be060dd24c82f6debc3a8e2ee7c73f5157bd0d38f15c987b9e94dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5bcf2f2a-d7c9-4502-9f84-008f360a0d03.vbs

Filesize
516B

MD5
dc972dcd851fb8bb9bbf5a846ae59ecd

SHA1
22a927d6028c56f79ceb15cfbe8d3d3a6f747474

SHA256
bf22f829a3019ac3601349e76dc6b648032ea63065fd38724be6b6404f5acded

SHA512
1697651cad43e25c666108f9f90f13858aa9d1f128f1dd84eafae98f393487307b14063b70a05c6ea2b9ee29402095f5b7e13afd22ed836884e88d791dc691b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\75306b8d-6277-4999-9e7a-a9e2a9188cc2.vbs

Filesize
740B

MD5
dc4b20205db43612ca9505284b7ef51f

SHA1
4565dcf9b1b38612904604b9722685acdfd79d78

SHA256
480282590f492ed21b43a5632fa7ba4324450135ff73bb335f415986939f503e

SHA512
6ca17a436dd919979f19b73a6a629a1cbf7dbaf5af2312c88384aeccc8971df07d4f0ba71e30c696697520b2938cca9f1e2ffd2bcb60cb6f38237d6b7eccf458

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5if2uaed.ta0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bcbc62a2-a21e-4125-9d56-1d2b01a3fe81.vbs

Filesize
740B

MD5
3317a0bcb088fcc2575c74818f6c2393

SHA1
05d784e5e377cced4214e07cab6a88ef377b440d

SHA256
635add246edd49322cba9d21c89e996736a81d8e986871ee1976a528317db1cb

SHA512
02f67886f2e79e68c17930ec77b61a0d0d39b0cd4c7c5b87b03c87a6ef8d6e3c127d2ef1880784991870a5788f8c3620c94927038dad674240ff21a285e1bbb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\c2e8cd62-b1ec-4068-96b8-cfed3af3139e.vbs

Filesize
740B

MD5
357bbaa6b7ba3d12cf0b7d5db9890477

SHA1
f736a69a784ff64d2af6fb28784e25fb46432b61

SHA256
b24209386ed048e73d28ece77e24bfa280da669178edbb4f8d9c8255275010a5

SHA512
aa75b378074fc58c892f98de8c7f53756b24279a1880c8aa46bff814c5eb6911d87481d270ed907419ad30c4018415e68b04347f1d055d79beec592e47262b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\d92ec61a-3f1d-44a8-bf82-70255598c048.vbs

Filesize
740B

MD5
622e52f512dc7ad4d0e25d5576a84ea8

SHA1
5819580baad926f4453011dcc65889128531fbee

SHA256
e08ec8be23b1cf94fc1b9a4e373328e48f698441561151a62cb7fba8d5e96474

SHA512
3fb2316d049155940b21cb2ed5e42b37c2f8d7e0c19bbe7469587e222bd35ddc8aa6ae82361fd4cb0e942283a53b78d4d637442914fd40b5fe4632f8fcdb6c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dfacacd4-fcf7-40d6-a275-c3275fcb313b.vbs

Filesize
739B

MD5
f3c403050d63352d1ccc665fd80cf670

SHA1
e9a602354d0c97e4edb31f6fc8ffdfbbb43e9bf9

SHA256
fd9ebe27f8abc3e15448d5341be9a6fdea539d689d3554fb4306f6a7ac118649

SHA512
bbba015a140ede841d4f98f3316d60d8350bb8a5ce7d56603f9889612a0662e28d7a593ae3eb106e17936fce0857ecfa883988b3432b334a28b3af19a4226ab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8531.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\OneDrive\RuntimeBroker.exe

Filesize
4.9MB

MD5
f718a136054a803c29f65669807defcf

SHA1
97cd50073d97d424fa1c8120d64b2dab95485061

SHA256
12d350c14114ba9295594678f62cd8872945f53fa8887dbfe7ed5f12621715be

SHA512
54ba620a9f373a8e6d1aa5f95ad409858089cd75c1802301ce34a98084a8110376a0bd51092cfb7bc065cb113ce06abda0a8b1c75fe45d5c9b27e63af0703c61

Download Submit
memory/608-372-0x00000258220E0000-0x00000258222FC000-memory.dmp

Filesize
2.1MB

Download
memory/2496-238-0x00000147B4A40000-0x00000147B4A62000-memory.dmp

Filesize
136KB

Download
memory/2496-347-0x00000147CCB20000-0x00000147CCD3C000-memory.dmp

Filesize
2.1MB

Download
memory/2604-375-0x0000025338530000-0x000002533874C000-memory.dmp

Filesize
2.1MB

Download
memory/2912-363-0x000001A519820000-0x000001A519A3C000-memory.dmp

Filesize
2.1MB

Download
memory/2956-577-0x000000001D440000-0x000000001D452000-memory.dmp

Filesize
72KB

Download
memory/3028-354-0x00000191F2340000-0x00000191F255C000-memory.dmp

Filesize
2.1MB

Download
memory/3204-89-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3864-14-0x00000000029D0000-0x00000000029DE000-memory.dmp

Filesize
56KB

Download
memory/3864-0-0x00007FF8B9233000-0x00007FF8B9235000-memory.dmp

Filesize
8KB

Download
memory/3864-164-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/3864-150-0x00007FF8B9233000-0x00007FF8B9235000-memory.dmp

Filesize
8KB

Download
memory/3864-18-0x000000001B780000-0x000000001B78C000-memory.dmp

Filesize
48KB

Download
memory/3864-17-0x000000001B770000-0x000000001B778000-memory.dmp

Filesize
32KB

Download
memory/3864-1-0x0000000000300000-0x00000000007F4000-memory.dmp

Filesize
5.0MB

Download
memory/3864-2-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/3864-16-0x000000001B760000-0x000000001B768000-memory.dmp

Filesize
32KB

Download
memory/3864-13-0x00000000029C0000-0x00000000029CA000-memory.dmp

Filesize
40KB

Download
memory/3864-7-0x0000000001160000-0x0000000001170000-memory.dmp

Filesize
64KB

Download
memory/3864-4-0x0000000001130000-0x000000000114C000-memory.dmp

Filesize
112KB

Download
memory/3864-15-0x00000000029E0000-0x00000000029EE000-memory.dmp

Filesize
56KB

Download
memory/3864-344-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/3864-6-0x0000000001150000-0x0000000001158000-memory.dmp

Filesize
32KB

Download
memory/3864-3-0x000000001B5E0000-0x000000001B70E000-memory.dmp

Filesize
1.2MB

Download
memory/3864-12-0x000000001C310000-0x000000001C838000-memory.dmp

Filesize
5.2MB

Download
memory/3864-11-0x00000000029B0000-0x00000000029C2000-memory.dmp

Filesize
72KB

Download
memory/3864-10-0x00000000029A0000-0x00000000029AA000-memory.dmp

Filesize
40KB

Download
memory/3864-9-0x0000000002990000-0x00000000029A0000-memory.dmp

Filesize
64KB

Download
memory/3864-8-0x0000000002970000-0x0000000002986000-memory.dmp

Filesize
88KB

Download
memory/3864-5-0x000000001B710000-0x000000001B760000-memory.dmp

Filesize
320KB

Download
memory/3936-361-0x00000206E9AB0000-0x00000206E9CCC000-memory.dmp

Filesize
2.1MB

Download
memory/4740-378-0x00000180779F0000-0x0000018077C0C000-memory.dmp

Filesize
2.1MB

Download
memory/4768-362-0x000001BEF6A80000-0x000001BEF6C9C000-memory.dmp

Filesize
2.1MB

Download
memory/4944-353-0x000001A5D62A0000-0x000001A5D64BC000-memory.dmp

Filesize
2.1MB

Download
memory/4992-368-0x000001FA317F0000-0x000001FA31A0C000-memory.dmp

Filesize
2.1MB

Download
memory/4996-369-0x00000218FAB50000-0x00000218FAD6C000-memory.dmp

Filesize
2.1MB

Download