colibri | 412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36f

Analysis

max time kernel
119s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Size

4.9MB
MD5

6d28b82da857e5f86596ed8e27efb260
SHA1

05fb88ba2cf61b8d55fea21d273fa2f2cb6afa9a
SHA256

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36f
SHA512

2cb1a0bef640341cf2cbda78430b18fd8218fd4f19a0801afb2a64223551902753a99892625be76a6d4aed34bb192408921206663d64b916e0298d5fa5572fdf
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	pid	Process
		5024	schtasks.exe
		2980	schtasks.exe
		1000	schtasks.exe
		1940	schtasks.exe
		1296	schtasks.exe
		3340	schtasks.exe
		1544	schtasks.exe
		4212	schtasks.exe
		1372	schtasks.exe
		3500	schtasks.exe
		1520	schtasks.exe
		4920	schtasks.exe
		1932	schtasks.exe
		1680	schtasks.exe
		3788	schtasks.exe
		1684	schtasks.exe
		752	schtasks.exe
		940	schtasks.exe
		1092	schtasks.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\cc11b995f2a76d		412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
		1080	schtasks.exe
		2276	schtasks.exe
		4640	schtasks.exe
		2656	schtasks.exe
		4428	schtasks.exe
		2664	schtasks.exe
		3064	schtasks.exe
		1192	schtasks.exe
		3476	schtasks.exe
		760	schtasks.exe
		3496	schtasks.exe
		536	schtasks.exe
		3060	schtasks.exe
		3836	schtasks.exe
		4624	schtasks.exe
		4728	schtasks.exe
		2408	schtasks.exe
		4736	schtasks.exe
		2460	schtasks.exe
		1732	schtasks.exe
		4440	schtasks.exe
		3292	schtasks.exe
		3728	schtasks.exe
File created	C:\Program Files (x86)\Microsoft.NET\5b884080fd4f94		412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
		2960	schtasks.exe
		628	schtasks.exe
		4524	schtasks.exe
		4512	schtasks.exe
		760	schtasks.exe
		1628	schtasks.exe
		1564	schtasks.exe
		4044	schtasks.exe
		4920	schtasks.exe
		2932	schtasks.exe
		2448	schtasks.exe
		4836	schtasks.exe
		1036	schtasks.exe
		3576	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
		4480	schtasks.exe
		828	schtasks.exe
		1228	schtasks.exe
		3176	schtasks.exe
		3184	schtasks.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	1604	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	1604	schtasks.exe	82

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

TrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exeTrustedInstaller.exeTrustedInstaller.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exeTrustedInstaller.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/3764-3-0x000000001B9C0000-0x000000001BAEE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2040	powershell.exe
3572	powershell.exe
1012	powershell.exe
2448	powershell.exe
4332	powershell.exe
2900	powershell.exe
2936	powershell.exe
2296	powershell.exe
1216	powershell.exe
4504	powershell.exe
640	powershell.exe
3492	powershell.exe
2228	powershell.exe
3340	powershell.exe
208	powershell.exe
4764	powershell.exe
4540	powershell.exe
1848	powershell.exe
2920	powershell.exe
216	powershell.exe
5008	powershell.exe
2076	powershell.exe
4436	powershell.exe
4824	powershell.exe
4828	powershell.exe
3884	powershell.exe
4420	powershell.exe
1364	powershell.exe
4852	powershell.exe
212	powershell.exe
244	powershell.exe
2356	powershell.exe
1756	powershell.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TrustedInstaller.exeTrustedInstaller.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	TrustedInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	TrustedInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	TrustedInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	TrustedInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	TrustedInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	TrustedInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	TrustedInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	TrustedInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	TrustedInstaller.exe

Executes dropped EXE 37 IoCs

Processes:

tmpB103.tmp.exetmpB103.tmp.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exetmpC208.tmp.exetmpC208.tmp.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exetmpE6F5.tmp.exetmpE6F5.tmp.exeTrustedInstaller.exetmp2B12.tmp.exetmp2B12.tmp.exeTrustedInstaller.exetmp4716.tmp.exetmp4716.tmp.exeTrustedInstaller.exetmp7877.tmp.exetmp7877.tmp.exetmp7877.tmp.exetmp7877.tmp.exeTrustedInstaller.exetmp9536.tmp.exetmp9536.tmp.exeTrustedInstaller.exetmpB0FC.tmp.exetmpB0FC.tmp.exeTrustedInstaller.exetmpE28B.tmp.exeTrustedInstaller.exetmp12A4.tmp.exetmp12A4.tmp.exeTrustedInstaller.exetmp4491.tmp.exetmp4491.tmp.exetmp4491.tmp.exeTrustedInstaller.exetmp7574.tmp.exetmp7574.tmp.exe

pid	Process
1548	tmpB103.tmp.exe
2584	tmpB103.tmp.exe
3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
4268	tmpC208.tmp.exe
232	tmpC208.tmp.exe
2760	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
4332	tmpE6F5.tmp.exe
2180	tmpE6F5.tmp.exe
4380	TrustedInstaller.exe
2460	tmp2B12.tmp.exe
4432	tmp2B12.tmp.exe
4812	TrustedInstaller.exe
2980	tmp4716.tmp.exe
1980	tmp4716.tmp.exe
4288	TrustedInstaller.exe
2624	tmp7877.tmp.exe
2208	tmp7877.tmp.exe
3724	tmp7877.tmp.exe
4068	tmp7877.tmp.exe
3076	TrustedInstaller.exe
3872	tmp9536.tmp.exe
4636	tmp9536.tmp.exe
2856	TrustedInstaller.exe
2444	tmpB0FC.tmp.exe
1968	tmpB0FC.tmp.exe
1280	TrustedInstaller.exe
4316	tmpE28B.tmp.exe
3484	TrustedInstaller.exe
1828	tmp12A4.tmp.exe
3076	tmp12A4.tmp.exe
228	TrustedInstaller.exe
4448	tmp4491.tmp.exe
2760	tmp4491.tmp.exe
536	tmp4491.tmp.exe
3788	TrustedInstaller.exe
4288	tmp7574.tmp.exe
1172	tmp7574.tmp.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exeTrustedInstaller.exeTrustedInstaller.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TrustedInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TrustedInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TrustedInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

tmpB103.tmp.exetmpC208.tmp.exetmpE6F5.tmp.exetmp2B12.tmp.exetmp4716.tmp.exetmp7877.tmp.exetmp9536.tmp.exetmpB0FC.tmp.exetmp12A4.tmp.exetmp4491.tmp.exetmp7574.tmp.exe

description	pid	Process	procid_target
PID 1548 set thread context of 2584	1548	tmpB103.tmp.exe	113
PID 4268 set thread context of 232	4268	tmpC208.tmp.exe	126
PID 4332 set thread context of 2180	4332	tmpE6F5.tmp.exe	216
PID 2460 set thread context of 4432	2460	tmp2B12.tmp.exe	249
PID 2980 set thread context of 1980	2980	tmp4716.tmp.exe	255
PID 3724 set thread context of 4068	3724	tmp7877.tmp.exe	263
PID 3872 set thread context of 4636	3872	tmp9536.tmp.exe	269
PID 2444 set thread context of 1968	2444	tmpB0FC.tmp.exe	275
PID 1828 set thread context of 3076	1828	tmp12A4.tmp.exe	290
PID 2760 set thread context of 536	2760	tmp4491.tmp.exe	297
PID 4288 set thread context of 1172	4288	tmp7574.tmp.exe	303

Drops file in Program Files directory 41 IoCs

Processes:

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

description	ioc	Process
File created	C:\Program Files\Windows Mail\56085415360792	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Microsoft.NET\5b884080fd4f94	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\winlogon.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Microsoft.NET\conhost.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files\7-Zip\Lang\886983d96e3d3e	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files\Crashpad\attachments\04c1e7795967e4	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\StartMenuExperienceHost.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\55b276f4edf653	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\WmiPrvSE.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Microsoft.NET\088424020bedd6	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files\Common Files\Services\WmiPrvSE.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files\Windows Mail\wininit.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files\7-Zip\Lang\csrss.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files\Crashpad\attachments\TrustedInstaller.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Windows Mail\f3b6ecef712a24	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Internet Explorer\WmiPrvSE.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\Registry.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files\Common Files\Services\WmiPrvSE.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\winlogon.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXACEB.tmp	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files\Crashpad\attachments\TrustedInstaller.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\conhost.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\cc11b995f2a76d	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Windows Mail\spoolsv.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files\Windows Mail\wininit.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\Registry.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\ee2ad38f3d4382	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\StartMenuExperienceHost.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RCXAAE7.tmp	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\powershell.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files\Common Files\Services\24dbde2999530e	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\spoolsv.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Internet Explorer\24dbde2999530e	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\38384e6a620884	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Program Files\7-Zip\Lang\csrss.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\powershell.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\e978f868350d50	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

Drops file in Windows directory 10 IoCs

Processes:

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

description	ioc	Process
File created	C:\Windows\Resources\Themes\fontdrvhost.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Windows\Resources\Themes\fontdrvhost.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Windows\bcastdvr\WaaSMedicAgent.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Windows\bcastdvr\c82b8037eab33d	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Windows\tracing\Registry.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Windows\tracing\ee2ad38f3d4382	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Windows\CSC\dwm.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Windows\bcastdvr\WaaSMedicAgent.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File opened for modification	C:\Windows\tracing\Registry.exe	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
File created	C:\Windows\Resources\Themes\5b884080fd4f94	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3336	4316	WerFault.exe	279

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

tmpE6F5.tmp.exetmp2B12.tmp.exetmpB0FC.tmp.exetmpB103.tmp.exetmp7877.tmp.exetmp7877.tmp.exetmp4491.tmp.exetmp4716.tmp.exetmp7877.tmp.exetmpE28B.tmp.exetmp12A4.tmp.exetmpC208.tmp.exetmp9536.tmp.exetmp4491.tmp.exetmp7574.tmp.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE6F5.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2B12.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB0FC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB103.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7877.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7877.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4491.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4716.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7877.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE28B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp12A4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC208.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9536.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4491.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7574.tmp.exe

Modifies registry class 12 IoCs

Processes:

TrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	TrustedInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	TrustedInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	TrustedInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	TrustedInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	TrustedInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	TrustedInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	TrustedInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	TrustedInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	TrustedInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
5024	schtasks.exe
3788	schtasks.exe
3060	schtasks.exe
1036	schtasks.exe
1372	schtasks.exe
760	schtasks.exe
3176	schtasks.exe
2980	schtasks.exe
1516	schtasks.exe
224	schtasks.exe
1228	schtasks.exe
3064	schtasks.exe
1628	schtasks.exe
536	schtasks.exe
1000	schtasks.exe
4624	schtasks.exe
1468	schtasks.exe
2448	schtasks.exe
4440	schtasks.exe
4044	schtasks.exe
3340	schtasks.exe
3292	schtasks.exe
2656	schtasks.exe
2664	schtasks.exe
2408	schtasks.exe
4728	schtasks.exe
4512	schtasks.exe
1544	schtasks.exe
1684	schtasks.exe
4116	schtasks.exe
760	schtasks.exe
3136	schtasks.exe
4736	schtasks.exe
3576	schtasks.exe
2460	schtasks.exe
1092	schtasks.exe
3476	schtasks.exe
2960	schtasks.exe
3496	schtasks.exe
4524	schtasks.exe
1940	schtasks.exe
3728	schtasks.exe
640	schtasks.exe
4640	schtasks.exe
828	schtasks.exe
1932	schtasks.exe
4920	schtasks.exe
4352	schtasks.exe
1564	schtasks.exe
3184	schtasks.exe
1080	schtasks.exe
1732	schtasks.exe
4836	schtasks.exe
2932	schtasks.exe
1296	schtasks.exe
4920	schtasks.exe
752	schtasks.exe
1192	schtasks.exe
4212	schtasks.exe
1680	schtasks.exe
4428	schtasks.exe
4480	schtasks.exe
3500	schtasks.exe
2276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pid	Process
3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
2228	powershell.exe
2228	powershell.exe
3572	powershell.exe
3572	powershell.exe
212	powershell.exe
216	powershell.exe
212	powershell.exe
216	powershell.exe
208	powershell.exe
208	powershell.exe
4436	powershell.exe
4436	powershell.exe
1216	powershell.exe
1216	powershell.exe
244	powershell.exe
244	powershell.exe
2076	powershell.exe
2076	powershell.exe
4420	powershell.exe
4420	powershell.exe
2296	powershell.exe
2296	powershell.exe
212	powershell.exe
2296	powershell.exe
244	powershell.exe
208	powershell.exe
2228	powershell.exe
2228	powershell.exe
3572	powershell.exe
1216	powershell.exe
216	powershell.exe
4420	powershell.exe
2076	powershell.exe
4436	powershell.exe
3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
4824	powershell.exe
4824	powershell.exe
5008	powershell.exe
5008	powershell.exe
3340	powershell.exe
3340	powershell.exe
4764	powershell.exe
4764	powershell.exe
1012	powershell.exe
1364	powershell.exe
1012	powershell.exe
1364	powershell.exe
2448	powershell.exe
2448	powershell.exe
4504	powershell.exe
4504	powershell.exe
4540	powershell.exe
4540	powershell.exe
1364	powershell.exe
4332	powershell.exe
4332	powershell.exe
4828	powershell.exe
4828	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exe

description	pid	Process
Token: SeDebugPrivilege	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	208	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	244	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	3340	powershell.exe
Token: SeDebugPrivilege	1012	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeDebugPrivilege	2760	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	640	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	4380	TrustedInstaller.exe
Token: SeDebugPrivilege	4812	TrustedInstaller.exe
Token: SeDebugPrivilege	4288	TrustedInstaller.exe
Token: SeDebugPrivilege	3076	TrustedInstaller.exe
Token: SeDebugPrivilege	2856	TrustedInstaller.exe
Token: SeDebugPrivilege	1280	TrustedInstaller.exe
Token: SeDebugPrivilege	3484	TrustedInstaller.exe
Token: SeDebugPrivilege	228	TrustedInstaller.exe
Token: SeDebugPrivilege	3788	TrustedInstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exetmpB103.tmp.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exetmpC208.tmp.exe

description	pid	Process	procid_target
PID 3764 wrote to memory of 2296	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	89
PID 3764 wrote to memory of 2296	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	89
PID 3764 wrote to memory of 2076	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	90
PID 3764 wrote to memory of 2076	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	90
PID 3764 wrote to memory of 3572	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	91
PID 3764 wrote to memory of 3572	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	91
PID 3764 wrote to memory of 4436	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	92
PID 3764 wrote to memory of 4436	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	92
PID 3764 wrote to memory of 4420	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	93
PID 3764 wrote to memory of 4420	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	93
PID 3764 wrote to memory of 1216	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	94
PID 3764 wrote to memory of 1216	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	94
PID 3764 wrote to memory of 216	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	95
PID 3764 wrote to memory of 216	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	95
PID 3764 wrote to memory of 212	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	96
PID 3764 wrote to memory of 212	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	96
PID 3764 wrote to memory of 2228	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	97
PID 3764 wrote to memory of 2228	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	97
PID 3764 wrote to memory of 244	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	98
PID 3764 wrote to memory of 244	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	98
PID 3764 wrote to memory of 208	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	99
PID 3764 wrote to memory of 208	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	99
PID 3764 wrote to memory of 1548	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	111
PID 3764 wrote to memory of 1548	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	111
PID 3764 wrote to memory of 1548	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	111
PID 1548 wrote to memory of 2584	1548	tmpB103.tmp.exe	113
PID 1548 wrote to memory of 2584	1548	tmpB103.tmp.exe	113
PID 1548 wrote to memory of 2584	1548	tmpB103.tmp.exe	113
PID 1548 wrote to memory of 2584	1548	tmpB103.tmp.exe	113
PID 1548 wrote to memory of 2584	1548	tmpB103.tmp.exe	113
PID 1548 wrote to memory of 2584	1548	tmpB103.tmp.exe	113
PID 1548 wrote to memory of 2584	1548	tmpB103.tmp.exe	113
PID 3764 wrote to memory of 3568	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	114
PID 3764 wrote to memory of 3568	3764	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	114
PID 3568 wrote to memory of 4268	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	124
PID 3568 wrote to memory of 4268	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	124
PID 3568 wrote to memory of 4268	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	124
PID 4268 wrote to memory of 232	4268	tmpC208.tmp.exe	126
PID 4268 wrote to memory of 232	4268	tmpC208.tmp.exe	126
PID 4268 wrote to memory of 232	4268	tmpC208.tmp.exe	126
PID 4268 wrote to memory of 232	4268	tmpC208.tmp.exe	126
PID 4268 wrote to memory of 232	4268	tmpC208.tmp.exe	126
PID 4268 wrote to memory of 232	4268	tmpC208.tmp.exe	126
PID 4268 wrote to memory of 232	4268	tmpC208.tmp.exe	126
PID 3568 wrote to memory of 1364	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	127
PID 3568 wrote to memory of 1364	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	127
PID 3568 wrote to memory of 4824	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	128
PID 3568 wrote to memory of 4824	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	128
PID 3568 wrote to memory of 1012	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	129
PID 3568 wrote to memory of 1012	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	129
PID 3568 wrote to memory of 5008	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	130
PID 3568 wrote to memory of 5008	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	130
PID 3568 wrote to memory of 2448	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	131
PID 3568 wrote to memory of 2448	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	131
PID 3568 wrote to memory of 4504	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	132
PID 3568 wrote to memory of 4504	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	132
PID 3568 wrote to memory of 3340	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	133
PID 3568 wrote to memory of 3340	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	133
PID 3568 wrote to memory of 4332	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	134
PID 3568 wrote to memory of 4332	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	134
PID 3568 wrote to memory of 4764	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	135
PID 3568 wrote to memory of 4764	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	135
PID 3568 wrote to memory of 4828	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	136
PID 3568 wrote to memory of 4828	3568	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe	136

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

Processes:

TrustedInstaller.exeTrustedInstaller.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exeTrustedInstaller.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TrustedInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TrustedInstaller.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
"C:\Users\Admin\AppData\Local\Temp\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:208
- C:\Users\Admin\AppData\Local\Temp\tmpB103.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB103.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Users\Admin\AppData\Local\Temp\tmpB103.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpB103.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:2584
- C:\Users\Admin\AppData\Local\Temp\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
  "C:\Users\Admin\AppData\Local\Temp\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3568
- - C:\Users\Admin\AppData\Local\Temp\tmpC208.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpC208.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\tmpC208.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpC208.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L7XCWxQ1J0.bat"
    3⤵
    PID:4992
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe
      "C:\Users\Admin\AppData\Local\Temp\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\tmpE6F5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE6F5.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\tmpE6F5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE6F5.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:2180
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3492
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x2lq6Oz7Nh.bat"
        5⤵
        
        PID:3184
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2612
      - C:\Program Files\Crashpad\attachments\TrustedInstaller.exe
        
        "C:\Program Files\Crashpad\attachments\TrustedInstaller.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f98b1bf-4fe5-458c-99d5-b26e8e8c73eb.vbs"
        7⤵
        
        PID:1436
        
        C:\Program Files\Crashpad\attachments\TrustedInstaller.exe
        
        "C:\Program Files\Crashpad\attachments\TrustedInstaller.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6e6d815-59b6-4941-b6c7-fbcd88fa35a3.vbs"
        9⤵
        
        PID:4220
        
        C:\Program Files\Crashpad\attachments\TrustedInstaller.exe
        
        "C:\Program Files\Crashpad\attachments\TrustedInstaller.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\74a58f7c-8fe1-4987-bc76-6c767a1d5c33.vbs"
        11⤵
        
        PID:1012
        
        C:\Program Files\Crashpad\attachments\TrustedInstaller.exe
        
        "C:\Program Files\Crashpad\attachments\TrustedInstaller.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2b8a08d-7215-40f1-8894-735c1d3376dd.vbs"
        13⤵
        
        PID:1700
        
        C:\Program Files\Crashpad\attachments\TrustedInstaller.exe
        
        "C:\Program Files\Crashpad\attachments\TrustedInstaller.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\708014c0-d144-4bbd-b9c7-959418457bf4.vbs"
        15⤵
        
        PID:4136
        
        C:\Program Files\Crashpad\attachments\TrustedInstaller.exe
        
        "C:\Program Files\Crashpad\attachments\TrustedInstaller.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1bc03ce-1148-4765-9d4f-9df7640cd662.vbs"
        17⤵
        
        PID:2448
        
        C:\Program Files\Crashpad\attachments\TrustedInstaller.exe
        
        "C:\Program Files\Crashpad\attachments\TrustedInstaller.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cec915a3-042e-4d89-a518-d6bd5d270790.vbs"
        19⤵
        
        PID:548
        
        C:\Program Files\Crashpad\attachments\TrustedInstaller.exe
        
        "C:\Program Files\Crashpad\attachments\TrustedInstaller.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d7708ad-b5de-423b-b883-e0391097c241.vbs"
        21⤵
        
        PID:1036
        
        C:\Program Files\Crashpad\attachments\TrustedInstaller.exe
        
        "C:\Program Files\Crashpad\attachments\TrustedInstaller.exe"
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17189e86-82ec-4593-b096-cdb4d56bbd54.vbs"
        23⤵
        
        PID:4284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4d688b9-db01-4072-8723-78173f6f0e3b.vbs"
        23⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\tmp7574.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7574.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\tmp7574.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7574.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:1172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\562f0445-a84d-4769-90ed-fe87c53fb01d.vbs"
        21⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\tmp4491.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4491.tmp.exe"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\tmp4491.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4491.tmp.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\tmp4491.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4491.tmp.exe"
        23⤵
        Executes dropped EXE
        
        PID:536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\122492d9-8180-4370-a231-30b0a6ad3760.vbs"
        19⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\tmp12A4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp12A4.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\tmp12A4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp12A4.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:3076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b670a0c-8d6d-4a8e-9eff-776846848410.vbs"
        17⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\tmpE28B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE28B.tmp.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\tmpE28B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE28B.tmp.exe"
        18⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 312
        18⤵
        Program crash
        
        PID:3336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88982c90-40cf-4b0f-bc37-87dd242e0e42.vbs"
        15⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\tmpB0FC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB0FC.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\tmpB0FC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB0FC.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a967497-b7d9-416a-a476-82ff559f8147.vbs"
        13⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\tmp9536.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9536.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\tmp9536.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9536.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8cc0885c-8927-4116-90b3-f29b9f535cc5.vbs"
        11⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\tmp7877.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7877.tmp.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\tmp7877.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7877.tmp.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\tmp7877.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7877.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\tmp7877.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7877.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d2ab125-c9b2-4b28-a9b3-7f64a5e88e53.vbs"
        9⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\tmp4716.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4716.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\tmp4716.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4716.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2adf0025-798d-4ecc-bb06-21b8c4707b4b.vbs"
        7⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\tmp2B12.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2B12.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\tmp2B12.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2B12.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Default\SendTo\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default\SendTo\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Users\Default\SendTo\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\lua\powershell.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\lua\powershell.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\Resources\Themes\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\Resources\Themes\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Windows\bcastdvr\WaaSMedicAgent.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\bcastdvr\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\Windows\bcastdvr\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Windows\tracing\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\tracing\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Windows\tracing\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Desktop\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\Services\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\Services\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 8 /tr "'C:\Program Files\Crashpad\attachments\TrustedInstaller.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 12 /tr "'C:\Program Files\Crashpad\attachments\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN4" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Application Data\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN" /sc ONLOGON /tr "'C:\Users\Default\Application Data\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN4" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Application Data\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\Registry.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\Registry.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4316 -ip 4316
1⤵
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe

Filesize
4.9MB

MD5
6d28b82da857e5f86596ed8e27efb260

SHA1
05fb88ba2cf61b8d55fea21d273fa2f2cb6afa9a

SHA256
412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36f

SHA512
2cb1a0bef640341cf2cbda78430b18fd8218fd4f19a0801afb2a64223551902753a99892625be76a6d4aed34bb192408921206663d64b916e0298d5fa5572fdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\412289c384f270c9ea81d7498dedcb4be1f202f9dd74a1c480374745e9c1e36fN.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TrustedInstaller.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a1008cfb29cdc25b4180c736ec404335

SHA1
39760fbcc8c1a64e856e98d61ce194d39b727438

SHA256
0eb4209b0f8c0dce02580b4d3ec5692d33be08b1a61858aad0413116afc95558

SHA512
00c2cde1601217c28fd71c2daefb21c7fcfeeee7e6badcd1b7f353f4e6df7817f5c4665148a1468b10ea31547642b999e3db5914d6e5f0cb1123243fd9ef213f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e25058a5d8ac6b42d8c7c9883c598303

SHA1
bd9e6194a36a959772fc020f905244900ffc3d57

SHA256
9f6fe2203df58ba90b512b436fd74f5eeb4f39f4f9f54a41e882fc54e5f35d51

SHA512
0146f2d1298acf189005217784e952d6e99bf7c8bf24ae9e9af1a2ca3d881dca39f19f3ecd06c7d0ad919bc929edaf6e97e0ab2d7f71733b9422527c594ea0c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3e242d3c4b39d344f66c494424020c61

SHA1
194e596f33d54482e7880e91dc05e0d247a46399

SHA256
f688037cb0c9f9c97b3b906a6c0636c91ad1864564feb17bba4973cde361172e

SHA512
27c1cd6d72554fdce3b960458a1a6bd3f740aa7c22a313a80b043db283a224bf390648b9e59e6bdbf48020d082d728fbde569bee4ee2a610f21d659a7b3dfa02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4165c906a376e655973cef247b5128f1

SHA1
c6299b6ab8b2db841900de376e9c4d676d61131e

SHA256
fb0b3c822d300abbb892e6f218d6b4b62b80bb26d9184d1f4c731600053a3fc4

SHA512
15783f2d3687388339c06423bd18c17a5704cd367bf1a1d08e436088984c0b5c52dc88d3b8455495a8051ba9f977aae34b69453e5ee252d928e74dcdebd4a11a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c4fee36040f3f2bd5ab8cf4ceb483d10

SHA1
7766b611607f908c4161c7a4dd8f9f1f31e7aa3b

SHA256
b9bb27c86647601607b2568ccc541c36ffa769424eb6971898f231b1d7a9bf82

SHA512
51a102819956a0bfc076a1f9287ddad1cd39fa365a8ef4ecc24ae426c5cda6969db1dd8b2362dd836976d6fc916e6283185591beac49b4b1b7f5788eae695237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
815f9e54d2e55a6cd87a044f75fdba0c

SHA1
9e2c91b5d015a2f96539227ed0a5d83cf26f6c08

SHA256
ec7d07723ca9c032e3662c0a316318065854ed4dc54106a5214278cbd148e75f

SHA512
9198d94b9d3ef35693881e3dc3e1c7f4b42d98f23a27f58cec67309628504de6940f0ac58bff1de2923b9d1b2dd11be82ea98bad9419d2e22f610df01c7401a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
caae66b2d6030f85188e48e4ea3a9fa6

SHA1
108425bd97144fa0f92ff7b2109fec293d14a461

SHA256
a6c642eaf80247e9682be60ab5ae9ece4d042af56013d164d8047b6fd1aefa1d

SHA512
189119a2390e51a49ea0fb8ad1427279cc2bf85f220f3212957c50b33387623b42ab7736fb5a717757b5c4b99c570e7ed2e5e6a578424aafb5c126cdf129ea15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
48cc83090af5044d78cf2989a7d1bb25

SHA1
07ba570b04aebed6bff26cbc66fa5ac4d9f249eb

SHA256
c4060076432eea989d904304add15c3ec175073a5250fe858808d3b0e70a38a9

SHA512
85d732b6c4b316f53faa692dfdbb36359d158421a7a696d434d01535dca032bde8656bee09ffaabe6d457335acc6496a36effafc41caf9800eb3438891e6ab9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cc19bcff372d20459d3651ba8aef50e7

SHA1
3c6f1d4cdd647864fb97a16b1aefba67fcee11f7

SHA256
366473e774d8976c7fd4dc582220666fb61a4feb3f7c95e69b2a68ad9e446ec9

SHA512
a0e360ca4b6e874fd44612bf4b17f3722c0619da4f6bade12a62efadae88c2d33460114eaafa2bc3fb1cef5bea07e745b8bee24f15d0cacaff5f4a521b225080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
085e0a3b869f290afea5688a8ac4e7c5

SHA1
0fedef5057708908bcca9e7572be8f46cef4f3ca

SHA256
1fed2c9bc05b3fcb93f493124dbf1680c6445f67e3d49680257183132514509c

SHA512
bbac0555a05dbe83154a90caa44a653c8a05c87594a211548b165c5b1d231e3818830e754c0b6de3e5cb64dba3a5ad18bebae05cb9157e1dd46bce2a86d18ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
624e41a75a6dfd62039973dbbfdbe622

SHA1
f791e4cc85d6ae7039acef57a9025b173d7e963b

SHA256
ced1b5ac330145fa608627ad4de1dfb3533375f19b6da3d02ad202d0b7732bc1

SHA512
a13a128a5ea8aad3bcd5f3dbffa5fbfe7763370d8e43b546a1df1da3b0ec0d520cf5fcc8c25c22fd1e73ea1d00da1bee99305e028e71e193339e4fa8ce8f0b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b801d886e417a9bf405b2f0092e04fe1

SHA1
fa99fefa2f49af240141692f78c8c28f04205389

SHA256
57b1c29eef54567fcfdaa28d2923485cb6f77bb76dc54235965fb34f02a42636

SHA512
b2c8bf95b4c25d7fff388b5f3e04212c43af9588f7aed8a7cb251330ee18c89789eb1d294b8449ec2afeb9b5373d7a6dce8f4369b84cbfb6a7c7813341fa07ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9a7f35c006bbf5da72f9cb250ffbddb

SHA1
458a8cedc38dac109631d9fccb3bf6d2c5c0e89e

SHA256
a1db56d56e35a6c95f98204e40f69f70422969681d408e5edc4afbf732eef86b

SHA512
d341773d30e09214567c65f24cd1854f1e438b8528aa30d35b6baac16e671dde1245edda654f19343b7c160da45985ab53f08453e7f6286e272d544f8741c131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6b0fc4d38b057a256ba5f058930f7b0f

SHA1
2cd26292fd836507748dacd1628e3d3cee48eaec

SHA256
ece49381b0978ea846e0c9ddf2d5cd369f4b1d1ff79a8918b1b875a793786eec

SHA512
93b2be33eff592b955750cd14161474c35bd99819afb776151b60d9f7302810565a865f7dc60ae7a92154a8d628650c8999b2c301a2536ae60047a39b55a553f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
575c67abdb0b2c72de0d9dd38b94d791

SHA1
27783f259ffd096b21c02c70cb999bf860183124

SHA256
fdf985fb9c56b4462675c41f68555f8762dd7043b15750968208b88be87252bc

SHA512
61b23a15b52cf51b525993e8cfc0b9fd41d1bb28501c96a35f776bfa738390783ad266c2d0383a53770f3662dd118a45114d92afee63b4673e88008a6559b774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fdf15f7d08f3f7538ae67e5b3e5d23f4

SHA1
953ff0529053ce3a1930b4f5abba2364a8befbfc

SHA256
9f4964b9cf2c6d4915a8f2b9746dc5ff73d6f327c81370f92e0e7a611b28a707

SHA512
4fee933635376d1467e0be63d12fa897f83cbbf9cdd1ac79cce30dfaa2621d47e137e991b701f1ed9910767904dbfb6b89db2a02ce32edc410c83351f351d7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\0f98b1bf-4fe5-458c-99d5-b26e8e8c73eb.vbs

Filesize
734B

MD5
b5b06f234007bdb4e8277c8eeb9ce373

SHA1
5d98d0a20ff562552836b30a4920cc3bd7f7541a

SHA256
76578a388beffb450a9bc586221bc4aabc3b25f03134343ae5fded26b445acab

SHA512
ef9db0709842a734c21253fbb3214450bea06f5ce0fb5e176d8c2e4f4b163ce7d29e03cdd9eef55630b9defac415376883ce46b4cdcaa933337ac59883899483

Download Submit
C:\Users\Admin\AppData\Local\Temp\2adf0025-798d-4ecc-bb06-21b8c4707b4b.vbs

Filesize
510B

MD5
8acc931ccf63dab5796d5ee2b784b9a6

SHA1
ceeb22909a9000fcfa441ce671c165fc28369fb4

SHA256
62674734a3072539db9edff74a91c77ab1f7c323bdba6d3a1d06fb33ae5e5a9e

SHA512
d8c2a79950e380f971018587085cf418317aac88716702cbd4ddebbc665f4f16e310e1360875f45dfbc64455f2a3c36e97c1dc05ec6aebac04486ee400040b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\L7XCWxQ1J0.bat

Filesize
268B

MD5
7ac3da0cbf0058e27a682cf3f4c99290

SHA1
d94e0cbe75dc3254933b487ae3b41ac95d18f460

SHA256
0ea46bf724a9b0599b982fe2913be6c41d5bd938e1121dd30d84c889a438530c

SHA512
fecfb7884798f53b29ebfcf6da2cd3e7f7a00721f4a94ce90ed50945522a88c0eac4017e5a6b63badc1b63f19113ba411307d57dfdac7bfdd2ab75ab3e837f8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_doozjoeh.kmh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c6e6d815-59b6-4941-b6c7-fbcd88fa35a3.vbs

Filesize
734B

MD5
406819c441a8c3f75e27458fd3290c0e

SHA1
d27987d4bc213ce9e15bd730825e8017e540a874

SHA256
287f7509e8ce8ca0e5315e6e98bcf9410814308fcd9a9a5cf0dc055cb9fc110b

SHA512
34df333e7d97ac5d503155caa6549c219095ea21c823d741d4b2650a1c9e95ed3e03d461295cff1089f7f2c2c3320eb6f9954af33d11dffbd597134556d0a884

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB103.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\x2lq6Oz7Nh.bat

Filesize
223B

MD5
0bf9b0e9774f4b0b58f6dfab15755f8b

SHA1
15bff6f979ea3ce2dd347b031325acb1c943402a

SHA256
0e2ac03cf976095d515b6a6cf9bd731b3e32c90118b6c9475ec68d92e67f9bf0

SHA512
6db3330335521aef94e792e390a880f554e9c210f5e53d6e42c61fc96c9d834f29fe5009d19b57e590dd2ee66246c747dfdb0b4f9456f40a7a3941971f90e12d

Download Submit
memory/228-676-0x000000001B760000-0x000000001B772000-memory.dmp

Filesize
72KB

Download
memory/2228-49-0x000001BAD6D30000-0x000001BAD6D52000-memory.dmp

Filesize
136KB

Download
memory/2584-149-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2760-329-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/3764-15-0x000000001C170000-0x000000001C17E000-memory.dmp

Filesize
56KB

Download
memory/3764-11-0x000000001C140000-0x000000001C152000-memory.dmp

Filesize
72KB

Download
memory/3764-4-0x0000000001660000-0x000000000167C000-memory.dmp

Filesize
112KB

Download
memory/3764-2-0x00007FF83D600000-0x00007FF83E0C1000-memory.dmp

Filesize
10.8MB

Download
memory/3764-6-0x00000000012F0000-0x00000000012F8000-memory.dmp

Filesize
32KB

Download
memory/3764-7-0x0000000002F90000-0x0000000002FA0000-memory.dmp

Filesize
64KB

Download
memory/3764-3-0x000000001B9C0000-0x000000001BAEE000-memory.dmp

Filesize
1.2MB

Download
memory/3764-0-0x00007FF83D603000-0x00007FF83D605000-memory.dmp

Filesize
8KB

Download
memory/3764-8-0x0000000002FA0000-0x0000000002FB6000-memory.dmp

Filesize
88KB

Download
memory/3764-9-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3764-10-0x0000000002FD0000-0x0000000002FDA000-memory.dmp

Filesize
40KB

Download
memory/3764-5-0x000000001C0F0000-0x000000001C140000-memory.dmp

Filesize
320KB

Download
memory/3764-12-0x000000001C680000-0x000000001CBA8000-memory.dmp

Filesize
5.2MB

Download
memory/3764-18-0x000000001C1A0000-0x000000001C1AC000-memory.dmp

Filesize
48KB

Download
memory/3764-14-0x000000001C160000-0x000000001C16E000-memory.dmp

Filesize
56KB

Download
memory/3764-16-0x000000001C180000-0x000000001C188000-memory.dmp

Filesize
32KB

Download
memory/3764-154-0x00007FF83D600000-0x00007FF83E0C1000-memory.dmp

Filesize
10.8MB

Download
memory/3764-13-0x000000001C150000-0x000000001C15A000-memory.dmp

Filesize
40KB

Download
memory/3764-1-0x0000000000710000-0x0000000000C04000-memory.dmp

Filesize
5.0MB

Download
memory/3764-17-0x000000001C190000-0x000000001C198000-memory.dmp

Filesize
32KB

Download
memory/4380-543-0x000000001B880000-0x000000001B892000-memory.dmp

Filesize
72KB

Download
memory/4812-568-0x000000001B7C0000-0x000000001B7D2000-memory.dmp

Filesize
72KB

Download