colibri | 9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Size

4.9MB
MD5

1104e32eb6157e6798d194f9a6d29e90
SHA1

178fca5fa8a5b0977c812bd58bd8912393f33591
SHA256

9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9
SHA512

184de1c9150cea1ead9be483b46d80a6053d81760884ed935b7a9ef657c3286034a78b55ade810f5da9817e78516140356d401cbc68ba442ee13fabd44d9a35f
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	4056	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	4056	schtasks.exe	81

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1204-3-0x000000001B640000-0x000000001B76E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
400	powershell.exe
2616	powershell.exe
2952	powershell.exe
644	powershell.exe
2708	powershell.exe
212	powershell.exe
2468	powershell.exe
1388	powershell.exe
1200	powershell.exe
1048	powershell.exe
3264	powershell.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	sysmon.exe

Executes dropped EXE 31 IoCs

pid	Process
4352	tmpB605.tmp.exe
2580	tmpB605.tmp.exe
2080	sysmon.exe
3016	tmpDC18.tmp.exe
4960	tmpDC18.tmp.exe
4524	sysmon.exe
1424	tmp1037.tmp.exe
4704	tmp1037.tmp.exe
4596	tmp1037.tmp.exe
2488	sysmon.exe
1388	tmp4050.tmp.exe
4004	tmp4050.tmp.exe
1444	sysmon.exe
2080	sysmon.exe
4708	sysmon.exe
2872	tmpA97A.tmp.exe
3496	tmpA97A.tmp.exe
3304	sysmon.exe
1764	sysmon.exe
4400	tmpE318.tmp.exe
4860	tmpE318.tmp.exe
5064	tmpE318.tmp.exe
1640	sysmon.exe
5056	tmp134F.tmp.exe
4292	tmp134F.tmp.exe
2552	sysmon.exe
3952	tmp2F63.tmp.exe
1016	tmp2F63.tmp.exe
3960	sysmon.exe
2796	tmp5F3D.tmp.exe
960	tmp5F3D.tmp.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 2580	4352	tmpB605.tmp.exe	118
PID 3016 set thread context of 4960	3016	tmpDC18.tmp.exe	149
PID 4704 set thread context of 4596	4704	tmp1037.tmp.exe	159
PID 1388 set thread context of 4004	1388	tmp4050.tmp.exe	167
PID 2872 set thread context of 3496	2872	tmpA97A.tmp.exe	179
PID 4860 set thread context of 5064	4860	tmpE318.tmp.exe	189
PID 5056 set thread context of 4292	5056	tmp134F.tmp.exe	195
PID 3952 set thread context of 1016	3952	tmp2F63.tmp.exe	201
PID 2796 set thread context of 960	2796	tmp5F3D.tmp.exe	207

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\csrss.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Program Files (x86)\Microsoft\Temp\886983d96e3d3e	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\RCXC85D.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\csrss.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IME\sysmon.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\DigitalLocker\en-US\dllhost.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\tracing\6cb0b6c459d5d3	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\PLA\Templates\MusNotification.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\tracing\RCXB952.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\PLA\Templates\MusNotification.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\tracing\dwm.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\PLA\Templates\aa97147c4c782d	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\tracing\dwm.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\IME\sysmon.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\Migration\WTR\MusNotification.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\Migration\WTR\aa97147c4c782d	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\Provisioning\Autopilot\9e8d7a4ca61bd9	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\IME\RCXB1DC.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\dllhost.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\Migration\WTR\RCXB73E.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\Migration\WTR\MusNotification.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\PLA\Templates\RCXBF9F.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\Provisioning\Autopilot\RCXC435.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\IME\121e5b5079f7c0	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File created	C:\Windows\DigitalLocker\en-US\5940a34987c991	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCXB4BB.tmp	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
File opened for modification	C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE318.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp134F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5F3D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB605.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1037.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1037.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE318.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDC18.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4050.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA97A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2F63.tmp.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	sysmon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4880	schtasks.exe
4308	schtasks.exe
3992	schtasks.exe
1336	schtasks.exe
4860	schtasks.exe
4232	schtasks.exe
1736	schtasks.exe
1928	schtasks.exe
3956	schtasks.exe
2912	schtasks.exe
1440	schtasks.exe
1108	schtasks.exe
2688	schtasks.exe
3848	schtasks.exe
2280	schtasks.exe
2196	schtasks.exe
4212	schtasks.exe
4704	schtasks.exe
3428	schtasks.exe
2672	schtasks.exe
5072	schtasks.exe
428	schtasks.exe
2888	schtasks.exe
4804	schtasks.exe
4488	schtasks.exe
1652	schtasks.exe
2144	schtasks.exe
3748	schtasks.exe
2652	schtasks.exe
2576	schtasks.exe
4504	schtasks.exe
4784	schtasks.exe
3700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
1048	powershell.exe
1048	powershell.exe
212	powershell.exe
212	powershell.exe
3264	powershell.exe
3264	powershell.exe
2708	powershell.exe
2708	powershell.exe
400	powershell.exe
400	powershell.exe
1388	powershell.exe
1388	powershell.exe
644	powershell.exe
644	powershell.exe
2468	powershell.exe
2468	powershell.exe
2952	powershell.exe
2952	powershell.exe
1200	powershell.exe
1200	powershell.exe
2616	powershell.exe
2616	powershell.exe
212	powershell.exe
1048	powershell.exe
644	powershell.exe
2468	powershell.exe
2708	powershell.exe
3264	powershell.exe
400	powershell.exe
2952	powershell.exe
1200	powershell.exe
1388	powershell.exe
2616	powershell.exe
2080	sysmon.exe
2080	sysmon.exe
4524	sysmon.exe
2488	sysmon.exe
1444	sysmon.exe
2080	sysmon.exe
4708	sysmon.exe
3304	sysmon.exe
1764	sysmon.exe
1640	sysmon.exe
2552	sysmon.exe
3960	sysmon.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	644	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2080	sysmon.exe
Token: SeDebugPrivilege	4524	sysmon.exe
Token: SeDebugPrivilege	2488	sysmon.exe
Token: SeDebugPrivilege	1444	sysmon.exe
Token: SeDebugPrivilege	2080	sysmon.exe
Token: SeDebugPrivilege	4708	sysmon.exe
Token: SeDebugPrivilege	3304	sysmon.exe
Token: SeDebugPrivilege	1764	sysmon.exe
Token: SeDebugPrivilege	1640	sysmon.exe
Token: SeDebugPrivilege	2552	sysmon.exe
Token: SeDebugPrivilege	3960	sysmon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 4352	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	116
PID 1204 wrote to memory of 4352	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	116
PID 1204 wrote to memory of 4352	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	116
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 4352 wrote to memory of 2580	4352	tmpB605.tmp.exe	118
PID 1204 wrote to memory of 2952	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	119
PID 1204 wrote to memory of 2952	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	119
PID 1204 wrote to memory of 2616	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	120
PID 1204 wrote to memory of 2616	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	120
PID 1204 wrote to memory of 400	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	121
PID 1204 wrote to memory of 400	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	121
PID 1204 wrote to memory of 1388	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	122
PID 1204 wrote to memory of 1388	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	122
PID 1204 wrote to memory of 2468	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	123
PID 1204 wrote to memory of 2468	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	123
PID 1204 wrote to memory of 212	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	124
PID 1204 wrote to memory of 212	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	124
PID 1204 wrote to memory of 3264	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	125
PID 1204 wrote to memory of 3264	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	125
PID 1204 wrote to memory of 1048	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	126
PID 1204 wrote to memory of 1048	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	126
PID 1204 wrote to memory of 2708	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	127
PID 1204 wrote to memory of 2708	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	127
PID 1204 wrote to memory of 644	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	128
PID 1204 wrote to memory of 644	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	128
PID 1204 wrote to memory of 1200	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	129
PID 1204 wrote to memory of 1200	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	129
PID 1204 wrote to memory of 2080	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	141
PID 1204 wrote to memory of 2080	1204	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe	141
PID 2080 wrote to memory of 2808	2080	sysmon.exe	144
PID 2080 wrote to memory of 2808	2080	sysmon.exe	144
PID 2080 wrote to memory of 2756	2080	sysmon.exe	145
PID 2080 wrote to memory of 2756	2080	sysmon.exe	145
PID 2080 wrote to memory of 3016	2080	sysmon.exe	147
PID 2080 wrote to memory of 3016	2080	sysmon.exe	147
PID 2080 wrote to memory of 3016	2080	sysmon.exe	147
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 3016 wrote to memory of 4960	3016	tmpDC18.tmp.exe	149
PID 2808 wrote to memory of 4524	2808	WScript.exe	153
PID 2808 wrote to memory of 4524	2808	WScript.exe	153
PID 4524 wrote to memory of 3336	4524	sysmon.exe	154
PID 4524 wrote to memory of 3336	4524	sysmon.exe	154
PID 4524 wrote to memory of 4396	4524	sysmon.exe	155
PID 4524 wrote to memory of 4396	4524	sysmon.exe	155
PID 4524 wrote to memory of 1424	4524	sysmon.exe	156
PID 4524 wrote to memory of 1424	4524	sysmon.exe	156
PID 4524 wrote to memory of 1424	4524	sysmon.exe	156
PID 1424 wrote to memory of 4704	1424	tmp1037.tmp.exe	158
PID 1424 wrote to memory of 4704	1424	tmp1037.tmp.exe	158
PID 1424 wrote to memory of 4704	1424	tmp1037.tmp.exe	158
PID 4704 wrote to memory of 4596	4704	tmp1037.tmp.exe	159
PID 4704 wrote to memory of 4596	4704	tmp1037.tmp.exe	159
PID 4704 wrote to memory of 4596	4704	tmp1037.tmp.exe	159
PID 4704 wrote to memory of 4596	4704	tmp1037.tmp.exe	159

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe
"C:\Users\Admin\AppData\Local\Temp\9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1204
- C:\Users\Admin\AppData\Local\Temp\tmpB605.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB605.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\tmpB605.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpB605.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\IME\sysmon.exe
  "C:\Windows\IME\sysmon.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2080
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43e61ae1-8712-4538-b4a7-c6d0f5d0345b.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\IME\sysmon.exe
      C:\Windows\IME\sysmon.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4524
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91cd27ae-c0ec-4292-9ebe-2a3ae8af110b.vbs"
        5⤵
        
        PID:3336
      - C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96e80458-baed-442f-9511-c25a845280ce.vbs"
        7⤵
        
        PID:3840
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bafb4d80-221d-493e-b06d-7827c9d81fef.vbs"
        9⤵
        
        PID:4280
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cec7005a-5f8b-4a7c-b079-f8b8720bcbae.vbs"
        11⤵
        
        PID:888
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\029a167c-4c40-4378-930d-541a17a51e7e.vbs"
        13⤵
        
        PID:4980
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0f7a4b8-0da4-476a-9ec5-ad1650157759.vbs"
        15⤵
        
        PID:3580
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27603b95-a42a-4050-8234-af0325cd627b.vbs"
        17⤵
        
        PID:672
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f83c358d-878c-4207-9122-10e3c9f4c837.vbs"
        19⤵
        
        PID:4388
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8de96652-c388-47e4-81a3-a29529c4d7a2.vbs"
        21⤵
        
        PID:4532
        
        C:\Windows\IME\sysmon.exe
        
        C:\Windows\IME\sysmon.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a00f1be-6474-43c2-81b1-e43728a08bd4.vbs"
        23⤵
        
        PID:4688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a253deb0-5fd7-440a-9df4-5d40a1fd611c.vbs"
        23⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\tmp5F3D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5F3D.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\tmp5F3D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5F3D.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f0a7144-067d-4467-8634-c91212465789.vbs"
        21⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\tmp2F63.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2F63.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\tmp2F63.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2F63.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:1016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\308fb137-0d19-4fc3-b906-1b93af03cb34.vbs"
        19⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\tmp134F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp134F.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\tmp134F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp134F.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00d8fdc8-8681-451a-86d3-40434c848ba0.vbs"
        17⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE318.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\45ab0c79-75e2-4a69-85aa-08a89a8c77c7.vbs"
        15⤵
        
        PID:368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9d0e762-f4a0-4807-8a6a-1cbb96ad8a50.vbs"
        13⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA97A.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f592f505-46f6-441d-952a-83bcb5a1aa05.vbs"
        11⤵
        
        PID:1108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f39608bc-b5da-40a2-9b13-c70f8921470d.vbs"
        9⤵
        
        PID:4224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbbc87e6-8590-45c1-87e7-b5d7de4a1422.vbs"
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\tmp4050.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4050.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\tmp4050.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4050.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:4004
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fdafffdf-4fa3-494e-8c62-9fd73b0ac84b.vbs"
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1037.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:4596
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70a43cf7-cd7e-4576-94aa-4e4b86395068.vbs"
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\tmpDC18.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpDC18.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\tmpDC18.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpDC18.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Windows\IME\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\IME\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 5 /tr "'C:\Windows\Migration\WTR\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\tracing\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\tracing\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\tracing\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 7 /tr "'C:\Windows\PLA\Templates\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 5 /tr "'C:\Windows\PLA\Templates\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N9" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N" /sc ONLOGON /tr "'C:\Users\Default User\9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N9" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\Temp\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Temp\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\Temp\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Temp\csrss.exe

Filesize
4.9MB

MD5
8b6ba4db18f730ad24a6aa57a2a467d0

SHA1
a6a9be5fa9d50a735f491c0ec819dac8ddefeeee

SHA256
e527bc9fef2107153ef5a076bd36c6e91ec82e3654b062935d00360525d0dfa3

SHA512
6124984ccc72f90d6d44ecde7ce1e76057a570cdd63ed1e1fd21426fef004a7ceb8e04d691ad9c51438df606cff1de19eb476f5ac0a36673a16369be05be0d98

Download Submit
C:\ProgramData\explorer.exe

Filesize
4.9MB

MD5
1104e32eb6157e6798d194f9a6d29e90

SHA1
178fca5fa8a5b0977c812bd58bd8912393f33591

SHA256
9cdd1eac65b15a8e517f52b07c095ea7de43469b77943c4f57f20dfdaf0e05b9

SHA512
184de1c9150cea1ead9be483b46d80a6053d81760884ed935b7a9ef657c3286034a78b55ade810f5da9817e78516140356d401cbc68ba442ee13fabd44d9a35f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Temp\029a167c-4c40-4378-930d-541a17a51e7e.vbs

Filesize
701B

MD5
86cdc5ac45354437af449b55493ce2d4

SHA1
eefa944fbc01230f2f7f4516ed01294775c805d8

SHA256
c3a436b077c3d49a3e0783e7fc390e688c0e22ba236969e62de2770e839b0f3c

SHA512
2598d395cb792ed413fc5fa07541f381aeaeea14e05f2d1dbb1224de705ac7435cda582fdb6b03b5628a6190ac3ba1b2724387f8cda73aa41e9c6c254d29dddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\27603b95-a42a-4050-8234-af0325cd627b.vbs

Filesize
701B

MD5
4827778508abb4145ec4410346a0c2e6

SHA1
a8116ef41c16dc1535658c4a2f9809db16775d7f

SHA256
c5a5cb9ee2876483f2d5f849d0f5c2aea01bafe75942370129a871b3ba040aef

SHA512
b30f4bc935100cf3ae06baecbabb8317cc0fa664c570e1858ec064331526eee3fa2f31da25907a4971379d0dfc6bf23a744980c995b656092b0dc094bd4fc1a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\43e61ae1-8712-4538-b4a7-c6d0f5d0345b.vbs

Filesize
701B

MD5
64d01d37de9a31d66ce690a6a5c5ed15

SHA1
1c90bf63a38e85866bea6ad879e17e6e310d037a

SHA256
fb8e475a0f2997be6617c24c0a17aa61f3eea9dd2123def0e08e2d9930da03f9

SHA512
5f096e57a865b026484d63755ad28a2272944aa918b8ae60d603832156c1e0f834816376debdf2b5c111940337a316d295ab71a2746a9edccc047fa87fca45f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\70a43cf7-cd7e-4576-94aa-4e4b86395068.vbs

Filesize
477B

MD5
bf8ef3c454cb532c6c64de3655ae514a

SHA1
aee97266336e027aec953e3c80876544ade9337d

SHA256
4d06a06aac98067d74760ea26881d2ac50a5ab6a9950e6b102492600fc11941b

SHA512
667812ddd1b14156dac726ab083452b8e1efdf7afa869be6e57f5312a061e5e0c2c13093a5ded858473ca5c1be3b4012fcad68843feee1851ac1380e7cc7b6b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\91cd27ae-c0ec-4292-9ebe-2a3ae8af110b.vbs

Filesize
701B

MD5
f6ba67b125224c863b55e5f3d768c23c

SHA1
64e3e858f74ca994545bb97090ce0ea2eca210e7

SHA256
6ca6d9438af483d591bed91bc23535eba32d75ce8406be634ff385c84d806705

SHA512
3a9533a5e8fa6cb672adb5b58023fa4bb8b669e415ec8b31a76ec4e8a3023794872680aae68f459e5bdae4e5124fbd01db8c996c1746c0afe638818f609389bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\96e80458-baed-442f-9511-c25a845280ce.vbs

Filesize
701B

MD5
5dc8a4ac8e65c7fa86e418643f2e81ce

SHA1
fa3604fd64c68417981f86e8f1c3fdc2294325c9

SHA256
3a9e56b46b808ef144a8e71ff5821af0c07747d7c565ddba99e5286478de7c59

SHA512
d5a8f3b25c06f385b84c2554a07f7beedfc8ed678a154f9be34f01be9e1a6a884e010c54a4f489fd74577e3919334af41a5a4db8302238e84f54a10d1b17a0ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jk204ccg.ai3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bafb4d80-221d-493e-b06d-7827c9d81fef.vbs

Filesize
701B

MD5
3468e6342f544d4e982e3ff5c3195f67

SHA1
76a8feec8085c3478f14a46aaebd20b2fd715863

SHA256
0a74d6d0ccdb3d2d6fdcf33804eaaea94c956b44a83c5792988237534ae7d054

SHA512
f1de1782b6dd0702c4a32f6f82607120522d91d06916bbf87554cda9312539556739e3c00c03d0d25f6c1ef83b71b64d3d4fdb488ae0dd425fc7371726be8e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\f0f7a4b8-0da4-476a-9ec5-ad1650157759.vbs

Filesize
701B

MD5
63ca1f2eac9f272f86b1b2bc178775e5

SHA1
c31f0c298c7e221c084dd014f38f0f07fd4311ad

SHA256
50e701e30be343ca0a8147a68015ce328a49ffd5340df586bc8f318fba5a6956

SHA512
23489c2c09f8569e292075917733c22924b5ea793a2d42c89f149a929395d5670564d7bae48ef4b8220d1edab4303ac8ca1d8d797e7a235ecef6223f96a4dd9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB605.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
memory/1048-183-0x00000218B35E0000-0x00000218B3602000-memory.dmp

Filesize
136KB

Download
memory/1204-15-0x000000001B5B0000-0x000000001B5BE000-memory.dmp

Filesize
56KB

Download
memory/1204-7-0x000000001B4D0000-0x000000001B4E0000-memory.dmp

Filesize
64KB

Download
memory/1204-11-0x000000001B520000-0x000000001B532000-memory.dmp

Filesize
72KB

Download
memory/1204-17-0x000000001B5D0000-0x000000001B5D8000-memory.dmp

Filesize
32KB

Download
memory/1204-16-0x000000001B5C0000-0x000000001B5C8000-memory.dmp

Filesize
32KB

Download
memory/1204-13-0x000000001B530000-0x000000001B53A000-memory.dmp

Filesize
40KB

Download
memory/1204-260-0x00007FF9FEBA3000-0x00007FF9FEBA5000-memory.dmp

Filesize
8KB

Download
memory/1204-290-0x00007FF9FEBA0000-0x00007FF9FF661000-memory.dmp

Filesize
10.8MB

Download
memory/1204-10-0x000000001B510000-0x000000001B51A000-memory.dmp

Filesize
40KB

Download
memory/1204-18-0x000000001B5E0000-0x000000001B5EC000-memory.dmp

Filesize
48KB

Download
memory/1204-1-0x0000000000290000-0x0000000000784000-memory.dmp

Filesize
5.0MB

Download
memory/1204-12-0x000000001C2A0000-0x000000001C7C8000-memory.dmp

Filesize
5.2MB

Download
memory/1204-14-0x000000001B540000-0x000000001B54E000-memory.dmp

Filesize
56KB

Download
memory/1204-9-0x000000001B500000-0x000000001B510000-memory.dmp

Filesize
64KB

Download
memory/1204-8-0x000000001B4E0000-0x000000001B4F6000-memory.dmp

Filesize
88KB

Download
memory/1204-6-0x00000000010A0000-0x00000000010A8000-memory.dmp

Filesize
32KB

Download
memory/1204-0-0x00007FF9FEBA3000-0x00007FF9FEBA5000-memory.dmp

Filesize
8KB

Download
memory/1204-5-0x000000001B560000-0x000000001B5B0000-memory.dmp

Filesize
320KB

Download
memory/1204-4-0x0000000001080000-0x000000000109C000-memory.dmp

Filesize
112KB

Download
memory/1204-3-0x000000001B640000-0x000000001B76E000-memory.dmp

Filesize
1.2MB

Download
memory/1204-2-0x00007FF9FEBA0000-0x00007FF9FF661000-memory.dmp

Filesize
10.8MB

Download
memory/2580-66-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download