colibri | 468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99

Analysis

max time kernel
119s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
Size 4.9MB
Sample240928-beax2sydrm
SHA256 468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99
MD5 261b88ce85c81cd9d3296c430bc897d0
SHA1 0f05a6f1da522690e312c22d1ff63b46b77b5b1f
SHA512 df8c85e30bb4135034eaea615578e50b47f4a94d6c4e667a143858f2cb5f6350d689aafeda89f21215970298c2dab650b94b47c38aaa07c2af2d1648bd419a7d
SSDEEP 49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	4704	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	4704	schtasks.exe	82

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1932-3-0x000000001BEA0000-0x000000001BFCE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2892	powershell.exe
2888	powershell.exe
1936	powershell.exe
3984	powershell.exe
3152	powershell.exe
4320	powershell.exe
2232	powershell.exe
3956	powershell.exe
4036	powershell.exe
2072	powershell.exe
920	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 35 IoCs

pid	Process
4628	tmp7794.tmp.exe
4408	tmp7794.tmp.exe
4404	dllhost.exe
4496	tmpA103.tmp.exe
2908	tmpA103.tmp.exe
2604	dllhost.exe
2680	tmpD4A5.tmp.exe
2716	tmpD4A5.tmp.exe
4012	dllhost.exe
2072	tmp599.tmp.exe
3348	tmp599.tmp.exe
2632	dllhost.exe
5092	tmp2277.tmp.exe
3648	tmp2277.tmp.exe
464	dllhost.exe
4744	tmp5280.tmp.exe
1264	tmp5280.tmp.exe
1476	tmp5280.tmp.exe
2120	dllhost.exe
2216	dllhost.exe
2456	tmp8D18.tmp.exe
920	tmp8D18.tmp.exe
4416	tmp8D18.tmp.exe
1600	tmp8D18.tmp.exe
3416	dllhost.exe
4384	tmpBDBD.tmp.exe
5084	tmpBDBD.tmp.exe
556	dllhost.exe
2360	dllhost.exe
1552	tmp99B.tmp.exe
2668	tmp99B.tmp.exe
3960	dllhost.exe
4624	tmp264B.tmp.exe
4396	tmp264B.tmp.exe
1204	dllhost.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 4628 set thread context of 4408	4628	tmp7794.tmp.exe	124
PID 4496 set thread context of 2908	4496	tmpA103.tmp.exe	152
PID 2680 set thread context of 2716	2680	tmpD4A5.tmp.exe	158
PID 2072 set thread context of 3348	2072	tmp599.tmp.exe	167
PID 5092 set thread context of 3648	5092	tmp2277.tmp.exe	177
PID 1264 set thread context of 1476	1264	tmp5280.tmp.exe	184
PID 4416 set thread context of 1600	4416	tmp8D18.tmp.exe	195
PID 4384 set thread context of 5084	4384	tmpBDBD.tmp.exe	201
PID 1552 set thread context of 2668	1552	tmp99B.tmp.exe	210
PID 4624 set thread context of 4396	4624	tmp264B.tmp.exe	216

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\Install\{B03CCC4C-2FBB-4685-83CA-78028CCF38ED}\sysmon.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{B03CCC4C-2FBB-4685-83CA-78028CCF38ED}\RCX7437.tmp	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCX7EAD.tmp	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCX8BF1.tmp	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\4ac9b1dfe7832e	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RuntimeBroker.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{B03CCC4C-2FBB-4685-83CA-78028CCF38ED}\sysmon.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Program Files (x86)\Google\Update\Install\{B03CCC4C-2FBB-4685-83CA-78028CCF38ED}\121e5b5079f7c0	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Program Files\7-Zip\Lang\RuntimeBroker.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Program Files\7-Zip\Lang\9e8d7a4ca61bd9	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\RCX875B.tmp	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\winlogon.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Windows\Registration\CRMLog\RCX7C98.tmp	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Windows\Registration\CRMLog\System.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Windows\Registration\CRMLog\27d1bcfc3c54e0	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Windows\Fonts\0a1fd5f707cd16	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Windows\Fonts\sppsvc.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\winlogon.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Windows\Fonts\sppsvc.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Windows\System\Speech\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Windows\Registration\CRMLog\System.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\cc11b995f2a76d	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Windows\bcastdvr\RCX812E.tmp	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Windows\bcastdvr\unsecapp.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File opened for modification	C:\Windows\Fonts\RCX8547.tmp	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Windows\bcastdvr\unsecapp.exe	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
File created	C:\Windows\bcastdvr\29c1c3cc0f7685	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5280.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8D18.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8D18.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBDBD.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp99B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA103.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD4A5.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2277.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp264B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8D18.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7794.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp599.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5280.tmp.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2428	schtasks.exe
1128	schtasks.exe
2668	schtasks.exe
5072	schtasks.exe
1300	schtasks.exe
5036	schtasks.exe
664	schtasks.exe
372	schtasks.exe
3704	schtasks.exe
5104	schtasks.exe
4472	schtasks.exe
2392	schtasks.exe
2752	schtasks.exe
3884	schtasks.exe
1964	schtasks.exe
2996	schtasks.exe
2956	schtasks.exe
4732	schtasks.exe
1940	schtasks.exe
4788	schtasks.exe
4452	schtasks.exe
1628	schtasks.exe
4560	schtasks.exe
4100	schtasks.exe
4892	schtasks.exe
2988	schtasks.exe
2680	schtasks.exe
3680	schtasks.exe
3376	schtasks.exe
5040	schtasks.exe
3404	schtasks.exe
3480	schtasks.exe
4416	schtasks.exe
4364	schtasks.exe
4144	schtasks.exe
3960	schtasks.exe
4748	schtasks.exe
4540	schtasks.exe
784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
2888	powershell.exe
2888	powershell.exe
3984	powershell.exe
3984	powershell.exe
2072	powershell.exe
2072	powershell.exe
1936	powershell.exe
1936	powershell.exe
4320	powershell.exe
4320	powershell.exe
920	powershell.exe
920	powershell.exe
3152	powershell.exe
3152	powershell.exe
4036	powershell.exe
4036	powershell.exe
3956	powershell.exe
3956	powershell.exe
2232	powershell.exe
2232	powershell.exe
2892	powershell.exe
2892	powershell.exe
3984	powershell.exe
2888	powershell.exe
2072	powershell.exe
920	powershell.exe
1936	powershell.exe
3152	powershell.exe
4320	powershell.exe
4036	powershell.exe
2232	powershell.exe
3956	powershell.exe
2892	powershell.exe
4404	dllhost.exe
2604	dllhost.exe
4012	dllhost.exe
2632	dllhost.exe
464	dllhost.exe
2120	dllhost.exe
2216	dllhost.exe
3416	dllhost.exe
556	dllhost.exe
2360	dllhost.exe
3960	dllhost.exe
1204	dllhost.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	4320	powershell.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	4404	dllhost.exe
Token: SeDebugPrivilege	2604	dllhost.exe
Token: SeDebugPrivilege	4012	dllhost.exe
Token: SeDebugPrivilege	2632	dllhost.exe
Token: SeDebugPrivilege	464	dllhost.exe
Token: SeDebugPrivilege	2120	dllhost.exe
Token: SeDebugPrivilege	2216	dllhost.exe
Token: SeDebugPrivilege	3416	dllhost.exe
Token: SeDebugPrivilege	556	dllhost.exe
Token: SeDebugPrivilege	2360	dllhost.exe
Token: SeDebugPrivilege	3960	dllhost.exe
Token: SeDebugPrivilege	1204	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4628	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	122
PID 1932 wrote to memory of 4628	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	122
PID 1932 wrote to memory of 4628	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	122
PID 4628 wrote to memory of 4408	4628	tmp7794.tmp.exe	124
PID 4628 wrote to memory of 4408	4628	tmp7794.tmp.exe	124
PID 4628 wrote to memory of 4408	4628	tmp7794.tmp.exe	124
PID 4628 wrote to memory of 4408	4628	tmp7794.tmp.exe	124
PID 4628 wrote to memory of 4408	4628	tmp7794.tmp.exe	124
PID 4628 wrote to memory of 4408	4628	tmp7794.tmp.exe	124
PID 4628 wrote to memory of 4408	4628	tmp7794.tmp.exe	124
PID 1932 wrote to memory of 2892	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	125
PID 1932 wrote to memory of 2892	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	125
PID 1932 wrote to memory of 1936	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	126
PID 1932 wrote to memory of 1936	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	126
PID 1932 wrote to memory of 3956	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	127
PID 1932 wrote to memory of 3956	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	127
PID 1932 wrote to memory of 2888	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	128
PID 1932 wrote to memory of 2888	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	128
PID 1932 wrote to memory of 4036	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	129
PID 1932 wrote to memory of 4036	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	129
PID 1932 wrote to memory of 2072	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	130
PID 1932 wrote to memory of 2072	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	130
PID 1932 wrote to memory of 920	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	131
PID 1932 wrote to memory of 920	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	131
PID 1932 wrote to memory of 3152	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	132
PID 1932 wrote to memory of 3152	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	132
PID 1932 wrote to memory of 3984	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	133
PID 1932 wrote to memory of 3984	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	133
PID 1932 wrote to memory of 4320	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	134
PID 1932 wrote to memory of 4320	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	134
PID 1932 wrote to memory of 2232	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	135
PID 1932 wrote to memory of 2232	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	135
PID 1932 wrote to memory of 4404	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	147
PID 1932 wrote to memory of 4404	1932	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe	147
PID 4404 wrote to memory of 3004	4404	dllhost.exe	148
PID 4404 wrote to memory of 3004	4404	dllhost.exe	148
PID 4404 wrote to memory of 1100	4404	dllhost.exe	149
PID 4404 wrote to memory of 1100	4404	dllhost.exe	149
PID 4404 wrote to memory of 4496	4404	dllhost.exe	150
PID 4404 wrote to memory of 4496	4404	dllhost.exe	150
PID 4404 wrote to memory of 4496	4404	dllhost.exe	150
PID 4496 wrote to memory of 2908	4496	tmpA103.tmp.exe	152
PID 4496 wrote to memory of 2908	4496	tmpA103.tmp.exe	152
PID 4496 wrote to memory of 2908	4496	tmpA103.tmp.exe	152
PID 4496 wrote to memory of 2908	4496	tmpA103.tmp.exe	152
PID 4496 wrote to memory of 2908	4496	tmpA103.tmp.exe	152
PID 4496 wrote to memory of 2908	4496	tmpA103.tmp.exe	152
PID 4496 wrote to memory of 2908	4496	tmpA103.tmp.exe	152
PID 3004 wrote to memory of 2604	3004	WScript.exe	153
PID 3004 wrote to memory of 2604	3004	WScript.exe	153
PID 2604 wrote to memory of 4128	2604	dllhost.exe	154
PID 2604 wrote to memory of 4128	2604	dllhost.exe	154
PID 2604 wrote to memory of 5052	2604	dllhost.exe	155
PID 2604 wrote to memory of 5052	2604	dllhost.exe	155
PID 2604 wrote to memory of 2680	2604	dllhost.exe	156
PID 2604 wrote to memory of 2680	2604	dllhost.exe	156
PID 2604 wrote to memory of 2680	2604	dllhost.exe	156
PID 2680 wrote to memory of 2716	2680	tmpD4A5.tmp.exe	158
PID 2680 wrote to memory of 2716	2680	tmpD4A5.tmp.exe	158
PID 2680 wrote to memory of 2716	2680	tmpD4A5.tmp.exe	158
PID 2680 wrote to memory of 2716	2680	tmpD4A5.tmp.exe	158
PID 2680 wrote to memory of 2716	2680	tmpD4A5.tmp.exe	158
PID 2680 wrote to memory of 2716	2680	tmpD4A5.tmp.exe	158
PID 2680 wrote to memory of 2716	2680	tmpD4A5.tmp.exe	158

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
"C:\Users\Admin\AppData\Local\Temp\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1932
- C:\Users\Admin\AppData\Local\Temp\tmp7794.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp7794.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Users\Admin\AppData\Local\Temp\tmp7794.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp7794.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:4408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Recovery\WindowsRE\dllhost.exe
  "C:\Recovery\WindowsRE\dllhost.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4404
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd254905-36d4-4347-9678-1e275d7a062e.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Recovery\WindowsRE\dllhost.exe
      C:\Recovery\WindowsRE\dllhost.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2604
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2cbb0a17-3651-44a5-9ca3-645307aec1fe.vbs"
        5⤵
        
        PID:4128
      - C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62bebeaf-681c-4ee4-8f48-a51a0c00318e.vbs"
        7⤵
        
        PID:4172
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ceccdba8-9ac2-4029-a67f-552d35c44006.vbs"
        9⤵
        
        PID:1716
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3beb848-3264-48ac-9021-ff1f90642b9a.vbs"
        11⤵
        
        PID:4212
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\863ef123-bcfa-4d2c-80e8-db31f92c7719.vbs"
        13⤵
        
        PID:1980
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cda662dc-141b-42a4-894e-67216cb42ceb.vbs"
        15⤵
        
        PID:3496
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3416
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb491469-e9c6-490e-9523-be1383e01c07.vbs"
        17⤵
        
        PID:760
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4315f711-439d-4f7f-9f6c-2dfd8997e479.vbs"
        19⤵
        
        PID:4888
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ecdc3cc-d734-4a73-a2c3-b0788c7603e7.vbs"
        21⤵
        
        PID:5048
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e220bb6-bba7-4d57-a699-e9e21e42c4dc.vbs"
        23⤵
        
        PID:2644
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ea80cd7-9fe7-4726-893c-971e547d15dc.vbs"
        25⤵
        
        PID:5044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a06796d-2d73-42dd-b26d-9a39f402c049.vbs"
        25⤵
        
        PID:4384
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7827acc-0283-48e1-b0a2-8c9bd8046998.vbs"
        23⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\tmp264B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp264B.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\tmp264B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp264B.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12fe8247-5658-47d0-b327-8c22f66aca5f.vbs"
        21⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\tmp99B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp99B.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\tmp99B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp99B.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\457deaec-7404-4db0-87fb-1fa35b4bb849.vbs"
        19⤵
        
        PID:4212
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5df4e92-dea4-4fac-9dfa-0aa8c053217b.vbs"
        17⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\tmpBDBD.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBDBD.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\tmpBDBD.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBDBD.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ee0eac5-b053-4960-a118-6698401223e3.vbs"
        15⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\268243a6-753c-4967-874a-ab204f63cff3.vbs"
        13⤵
        
        PID:4612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72b19a1c-ab66-4ed7-a0a3-2a5645966dc0.vbs"
        11⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe"
        13⤵
        Executes dropped EXE
        
        PID:1476
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70c0b6af-98ca-4108-b532-7a6e2f01b6c6.vbs"
        9⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\tmp2277.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2277.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\tmp2277.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2277.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\018b5064-bbda-47fc-a0ee-a06d66139253.vbs"
        7⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\tmp599.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp599.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\tmp599.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp599.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:3348
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e97000c1-af3b-4cf2-bcb8-66edbf1156bd.vbs"
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\tmpD4A5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD4A5.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\tmpD4A5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD4A5.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:2716
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e59671bc-4e5c-4d55-98b5-5ca7a8e20d1b.vbs"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\tmpA103.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpA103.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\tmpA103.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpA103.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Update\Install\{B03CCC4C-2FBB-4685-83CA-78028CCF38ED}\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Install\{B03CCC4C-2FBB-4685-83CA-78028CCF38ED}\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Update\Install\{B03CCC4C-2FBB-4685-83CA-78028CCF38ED}\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Videos\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Videos\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Videos\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\Registration\CRMLog\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\CRMLog\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Windows\bcastdvr\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\bcastdvr\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\bcastdvr\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Fonts\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\Fonts\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N4" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N4" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dllhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log
Size 1KB
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
MD5 a8e8360d573a4ff072dcc6f09d992c88
SHA1 3446774433ceaf0b400073914facab11b98b6807
SHA512 4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
MD5 2e907f77659a6601fcc408274894da2e
SHA1 9f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA512 34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
MD5 SHA1 SHA512

Submit Download

2cbb0a17-3651-44a5-9ca3-645307aec1fe.vbs

Path C:\Users\Admin\AppData\Local\Temp\2cbb0a17-3651-44a5-9ca3-645307aec1fe.vbs
Size 709B
SHA256 752d756954eb97a6abc9ba2cce9bb2dbc7e1263cad956abe24f70a2fda87635e
MD5 323484c42d14e914518bd33a50a50b16
SHA1 facaecb49fd9e5d7069386c8f123b5ad448d7cd8
SHA512 1a641887c949edbf3d458280c01f6e5146ade85d3b73604417fb395c64984f169866774c089ef0060565aa4d2235c84de45ee7fb89d608586f95119e2969d6ee
MD5 SHA1 SHA512

Submit Download

62bebeaf-681c-4ee4-8f48-a51a0c00318e.vbs

Path C:\Users\Admin\AppData\Local\Temp\62bebeaf-681c-4ee4-8f48-a51a0c00318e.vbs
Size 709B
SHA256 0f24a08b0fa5ac143b871ef0583d48ccf3e481a9a7d7c05086a931aaff83b101
MD5 49a0859ec9c537b8742e4c215fcdba68
SHA1 d6cee7ac48f6646270bdfc4d26629ca471183d99
SHA512 29e518d9e108c2afc1dc4128577fea9599ad9123d796449ec2ed8ea867a84e20db7fd4eb2bdb06497df44dd49887f7205617c0505052390a1dd6ac438cf2d3a4
MD5 SHA1 SHA512

Submit Download

863ef123-bcfa-4d2c-80e8-db31f92c7719.vbs

Path C:\Users\Admin\AppData\Local\Temp\863ef123-bcfa-4d2c-80e8-db31f92c7719.vbs
Size 709B
SHA256 b9bee720422874529c17a1ee6704a61081a14945946272435f7fbf2f2a2a4232
MD5 ad5da9a1a891fb99df34818c79b672e9
SHA1 c19c01d0bb2a2a47dc3b9968d3b42fe97292bf6c
SHA512 d9cd268fe49d15358f563d0515c7d7fb47556fcf70c62de803b389f855804d68c515ed3100ecf79b232035e5786b41b113dceb70ac5e5d99985d56bd182d16a8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_fx0y1l24.b5n.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fx0y1l24.b5n.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

cda662dc-141b-42a4-894e-67216cb42ceb.vbs

Path C:\Users\Admin\AppData\Local\Temp\cda662dc-141b-42a4-894e-67216cb42ceb.vbs
Size 709B
SHA256 05f35f2121fec1e058c7efdff938d58d63f9fd24f413137b98134493d65c069b
MD5 d87f40ed2096bd23b023cf3232b00262
SHA1 55bb3cd6510d3784a81cf4bf7bed684477182cb5
SHA512 4d99cbc6081039ba5f18c86d9c195fc80b90d758cd79c833f279ae13ace32b4fd9765cbc2e44c6a346128c425e4aab271c427194176ea434ad99ca41535ff72a
MD5 SHA1 SHA512

Submit Download

ceccdba8-9ac2-4029-a67f-552d35c44006.vbs

Path C:\Users\Admin\AppData\Local\Temp\ceccdba8-9ac2-4029-a67f-552d35c44006.vbs
Size 709B
SHA256 2438c49624470e24b56801f852e9ea066aa477ef3172e682683cf4fe6ee400da
MD5 75de85d8df8ae095910df0f947747c6b
SHA1 baac9330af856c54c41f4fd8d31121b9974ac12e
SHA512 f73dca991b7f1077b083d2bd774d8f195632b2e736d398e34c6d15fdff8b7d2f603d3604d684e0150afea3c56a511760e1f0e5d138e6226ea85b914879361caf
MD5 SHA1 SHA512

Submit Download

d3beb848-3264-48ac-9021-ff1f90642b9a.vbs

Path C:\Users\Admin\AppData\Local\Temp\d3beb848-3264-48ac-9021-ff1f90642b9a.vbs
Size 708B
SHA256 1ec2c9de7c26cbdbea653d5ad54e4273ddaa8667d39cfe18bca490683babb4ad
MD5 8ae6900d199884116d0923348efcf3c8
SHA1 73185190a9bb9816753e6772bce60367757e372a
SHA512 3a1fe8e6fe86f0dbf1e4df957aa4999b3370fa5782650fc648310a56a3f58f6a3218e45bb90c776dcb4990786649b854eb7ed3189e9d412092f26e5a52059d4e
MD5 SHA1 SHA512

Submit Download

dd254905-36d4-4347-9678-1e275d7a062e.vbs

Path C:\Users\Admin\AppData\Local\Temp\dd254905-36d4-4347-9678-1e275d7a062e.vbs
Size 709B
SHA256 2cd65203f2207d2b4944d7a062ee83f95d14a1fc307da700ad3b88942608a29c
MD5 4aa9728b74cd7a273b885e864c34c8b2
SHA1 09e448f952c6dc422b1e440d5ce568796ca6743a
SHA512 dee02829482c91332db10141a282efcb66a30808327d4514668a815d7c68395a31f82c8e15f12b5199e0cfa80c359551233b607a7933942fff25e7e3d9dd6706
MD5 SHA1 SHA512

Submit Download

e59671bc-4e5c-4d55-98b5-5ca7a8e20d1b.vbs

Path C:\Users\Admin\AppData\Local\Temp\e59671bc-4e5c-4d55-98b5-5ca7a8e20d1b.vbs
Size 485B
SHA256 7c89852fc020a7b196dac2334a9453e854ae9e622a022c1ced7094c9911c43dd
MD5 7ea4877dbd489af9f7593f454c2f0dc1
SHA1 7414647c3c309a0799c8e3708a895d4078214c13
SHA512 205ef34b20e3bb960000397471204cfe3eb08f11424d0edca4b2b1dad4510592ad6a98e88dc759762c7ffc51e2b132169de35992d42f53497cecd87b4a4bcc6f
MD5 SHA1 SHA512

Submit Download

tmp7794.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp7794.tmp.exe
Size 75KB
SHA256 2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
MD5 e0a68b98992c1699876f818a22b5b907
SHA1 d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA512 856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
SSDEEP 768:mdU/rTZZAG7lad6fEW1PRLqHxVR/LfXGCCMzgAprfLJh0AiyqjXJwr:mdU/rT9oTWbw/LvfHh0AliXJwr
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.exe

Path C:\Windows\Registration\CRMLog\System.exe
Size 4.9MB
SHA256 468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99
MD5 261b88ce85c81cd9d3296c430bc897d0
SHA1 0f05a6f1da522690e312c22d1ff63b46b77b5b1f
SHA512 df8c85e30bb4135034eaea615578e50b47f4a94d6c4e667a143858f2cb5f6350d689aafeda89f21215970298c2dab650b94b47c38aaa07c2af2d1648bd419a7d
SSDEEP 49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1932-6-0x0000000003180000-0x0000000003188000-memory.dmp

Download

memory/1932-4-0x0000000003010000-0x000000000302C000-memory.dmp

Download

memory/1932-16-0x000000001BE50000-0x000000001BE58000-memory.dmp

Download

memory/1932-18-0x000000001BE70000-0x000000001BE7C000-memory.dmp

Download

memory/1932-1-0x0000000000B20000-0x0000000001014000-memory.dmp

Download

memory/1932-0-0x00007FFF286D3000-0x00007FFF286D5000-memory.dmp

Download

memory/1932-147-0x00007FFF286D3000-0x00007FFF286D5000-memory.dmp

Download

memory/1932-15-0x000000001BE40000-0x000000001BE4E000-memory.dmp

Download

memory/1932-2-0x00007FFF286D0000-0x00007FFF29191000-memory.dmp

Download

memory/1932-273-0x00007FFF286D0000-0x00007FFF29191000-memory.dmp

Download

memory/1932-285-0x00007FFF286D0000-0x00007FFF29191000-memory.dmp

Download

memory/1932-13-0x000000001BE20000-0x000000001BE2A000-memory.dmp

Download

memory/1932-17-0x000000001BE60000-0x000000001BE68000-memory.dmp

Download

memory/1932-10-0x00000000031D0000-0x00000000031DA000-memory.dmp

Download

memory/1932-12-0x000000001CB00000-0x000000001D028000-memory.dmp

Download

memory/1932-9-0x00000000031C0000-0x00000000031D0000-memory.dmp

Download

memory/1932-8-0x00000000031A0000-0x00000000031B6000-memory.dmp

Download

memory/1932-14-0x000000001BE30000-0x000000001BE3E000-memory.dmp

Download

memory/1932-3-0x000000001BEA0000-0x000000001BFCE000-memory.dmp

Download

memory/1932-7-0x0000000003190000-0x00000000031A0000-memory.dmp

Download

memory/1932-5-0x000000001BDC0000-0x000000001BE10000-memory.dmp

Download

memory/1932-11-0x000000001BE10000-0x000000001BE22000-memory.dmp

Download

memory/2604-333-0x000000001C120000-0x000000001C132000-memory.dmp

Download

memory/2888-191-0x0000024E9DB40000-0x0000024E9DB62000-memory.dmp

Download

memory/4408-78-0x0000000000400000-0x0000000000407000-memory.dmp

Download