colibri | 5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2024 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Size

4.9MB
MD5

fbad13694fbd76b4a28785c6fa12af90
SHA1

35aca1ddefc9672625d9e94fd886810f30eea843
SHA256

5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2
SHA512

0e4ec2070b6fde55ea405611c7d8bc73520670608a6dc0e2f605c9a70c96bfa44135f988c7c1c29d20f0a1edd0390e056d9e6d6401d4a8aefee0fa96e1cb447b
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4168	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	460	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1120	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	4924	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	4924	schtasks.exe	82

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exewinlogon.exewinlogon.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/4964-3-0x000000001B510000-0x000000001B63E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
1152	powershell.exe
4336	powershell.exe
4248	powershell.exe
4652	powershell.exe
3440	powershell.exe
1008	powershell.exe
4312	powershell.exe
1376	powershell.exe
5096	powershell.exe
3956	powershell.exe
5000	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exe5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	winlogon.exe

Executes dropped EXE 41 IoCs

Processes:

tmp7958.tmp.exetmp7958.tmp.exewinlogon.exewinlogon.exetmpE62A.tmp.exetmpE62A.tmp.exewinlogon.exetmp2AB.tmp.exetmp2AB.tmp.exewinlogon.exetmp1E12.tmp.exetmp1E12.tmp.exetmp1E12.tmp.exewinlogon.exetmp4F73.tmp.exetmp4F73.tmp.exetmp4F73.tmp.exetmp4F73.tmp.exewinlogon.exetmp8076.tmp.exetmp8076.tmp.exewinlogon.exetmpB06F.tmp.exetmpB06F.tmp.exewinlogon.exetmpCD0F.tmp.exetmpCD0F.tmp.exewinlogon.exetmpFCD9.tmp.exetmpFCD9.tmp.exewinlogon.exetmp2CC3.tmp.exetmp2CC3.tmp.exewinlogon.exewinlogon.exetmp7749.tmp.exetmp7749.tmp.exewinlogon.exetmpA88B.tmp.exetmpA88B.tmp.exetmpA88B.tmp.exe

pid	Process
4948	tmp7958.tmp.exe
452	tmp7958.tmp.exe
648	winlogon.exe
1816	winlogon.exe
2256	tmpE62A.tmp.exe
1340	tmpE62A.tmp.exe
3440	winlogon.exe
4680	tmp2AB.tmp.exe
2392	tmp2AB.tmp.exe
1040	winlogon.exe
728	tmp1E12.tmp.exe
396	tmp1E12.tmp.exe
732	tmp1E12.tmp.exe
320	winlogon.exe
220	tmp4F73.tmp.exe
896	tmp4F73.tmp.exe
4396	tmp4F73.tmp.exe
3736	tmp4F73.tmp.exe
2996	winlogon.exe
3916	tmp8076.tmp.exe
3716	tmp8076.tmp.exe
4652	winlogon.exe
2916	tmpB06F.tmp.exe
5004	tmpB06F.tmp.exe
3240	winlogon.exe
2440	tmpCD0F.tmp.exe
3460	tmpCD0F.tmp.exe
2376	winlogon.exe
5000	tmpFCD9.tmp.exe
1976	tmpFCD9.tmp.exe
4732	winlogon.exe
1028	tmp2CC3.tmp.exe
4464	tmp2CC3.tmp.exe
3920	winlogon.exe
2404	winlogon.exe
2440	tmp7749.tmp.exe
1440	tmp7749.tmp.exe
1944	winlogon.exe
3764	tmpA88B.tmp.exe
3064	tmpA88B.tmp.exe
4020	tmpA88B.tmp.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

tmp7958.tmp.exetmpE62A.tmp.exetmp2AB.tmp.exetmp1E12.tmp.exetmp4F73.tmp.exetmp8076.tmp.exetmpB06F.tmp.exetmpCD0F.tmp.exetmpFCD9.tmp.exetmp2CC3.tmp.exetmp7749.tmp.exetmpA88B.tmp.exe

description	pid	Process	procid_target
PID 4948 set thread context of 452	4948	tmp7958.tmp.exe	142
PID 2256 set thread context of 1340	2256	tmpE62A.tmp.exe	183
PID 4680 set thread context of 2392	4680	tmp2AB.tmp.exe	190
PID 396 set thread context of 732	396	tmp1E12.tmp.exe	197
PID 4396 set thread context of 3736	4396	tmp4F73.tmp.exe	205
PID 3916 set thread context of 3716	3916	tmp8076.tmp.exe	211
PID 2916 set thread context of 5004	2916	tmpB06F.tmp.exe	217
PID 2440 set thread context of 3460	2440	tmpCD0F.tmp.exe	223
PID 5000 set thread context of 1976	5000	tmpFCD9.tmp.exe	229
PID 1028 set thread context of 4464	1028	tmp2CC3.tmp.exe	235
PID 2440 set thread context of 1440	2440	tmp7749.tmp.exe	244
PID 3064 set thread context of 4020	3064	tmpA88B.tmp.exe	251

Drops file in Program Files directory 49 IoCs

Processes:

5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\MSBuild\SearchApp.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Common Files\RCX89BC.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files\ModifiableWindowsApps\lsass.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Common Files\dllhost.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\5940a34987c991	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\ee2ad38f3d4382	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\RCX9B96.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX9DAB.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\9e8d7a4ca61bd9	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\MSBuild\38384e6a620884	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX7DA1.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\Registry.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cc11b995f2a76d	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\6203df4a6bafc7	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\csrss.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCX8023.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCX9066.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RuntimeBroker.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\SppExtComObj.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\e1ef82546f0b02	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCX8E52.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Google\Temp\fontdrvhost.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Common Files\5940a34987c991	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\6cb0b6c459d5d3	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\RCX7744.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\MSBuild\RCX82E3.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\fontdrvhost.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCX9915.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files\7-Zip\Lang\9e8d7a4ca61bd9	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\RCX7959.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\SppExtComObj.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\RCX84F7.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Common Files\dllhost.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\886983d96e3d3e	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\MSBuild\SearchApp.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Google\Temp\5b884080fd4f94	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\csrss.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files\7-Zip\Lang\RuntimeBroker.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\Registry.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe

Drops file in Windows directory 17 IoCs

Processes:

5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\RCXA02C.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Windows\Media\Quirky\upfc.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Windows\ServiceProfiles\6ccacd8608530f	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Windows\IdentityCRL\production\RCX8779.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Windows\Media\Quirky\upfc.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Windows\CbsTemp\SppExtComObj.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Windows\IdentityCRL\production\StartMenuExperienceHost.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Windows\ServiceProfiles\Idle.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Windows\ServiceProfiles\Idle.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Windows\Media\Quirky\RCX8C3D.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Windows\CbsTemp\SppExtComObj.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Windows\ServiceState\EventLog\Data\TextInputHost.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Windows\IdentityCRL\production\StartMenuExperienceHost.exe	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Windows\IdentityCRL\production\55b276f4edf653	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Windows\CbsTemp\e1ef82546f0b02	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File created	C:\Windows\Media\Quirky\ea1d8f6d871115	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
File opened for modification	C:\Windows\CbsTemp\RCX7B6E.tmp	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

tmp4F73.tmp.exetmpA88B.tmp.exetmpA88B.tmp.exetmp2AB.tmp.exetmp4F73.tmp.exetmp8076.tmp.exetmpB06F.tmp.exetmp1E12.tmp.exetmp1E12.tmp.exetmpFCD9.tmp.exetmp2CC3.tmp.exetmp7749.tmp.exetmp7958.tmp.exetmpE62A.tmp.exetmp4F73.tmp.exetmpCD0F.tmp.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4F73.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA88B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA88B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2AB.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4F73.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8076.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB06F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1E12.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1E12.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpFCD9.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2CC3.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7749.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7958.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE62A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4F73.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCD0F.tmp.exe

Modifies registry class 14 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	winlogon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
4776	schtasks.exe
1220	schtasks.exe
1988	schtasks.exe
3872	schtasks.exe
2520	schtasks.exe
3980	schtasks.exe
4036	schtasks.exe
4028	schtasks.exe
4780	schtasks.exe
4168	schtasks.exe
1784	schtasks.exe
2356	schtasks.exe
3960	schtasks.exe
4772	schtasks.exe
2848	schtasks.exe
3712	schtasks.exe
1120	schtasks.exe
3832	schtasks.exe
4608	schtasks.exe
3392	schtasks.exe
2292	schtasks.exe
4056	schtasks.exe
4436	schtasks.exe
4300	schtasks.exe
2756	schtasks.exe
3276	schtasks.exe
3396	schtasks.exe
3888	schtasks.exe
2252	schtasks.exe
4792	schtasks.exe
736	schtasks.exe
1796	schtasks.exe
1252	schtasks.exe
460	schtasks.exe
1660	schtasks.exe
1116	schtasks.exe
816	schtasks.exe
2300	schtasks.exe
1432	schtasks.exe
644	schtasks.exe
3260	schtasks.exe
3448	schtasks.exe
1232	schtasks.exe
3152	schtasks.exe
1060	schtasks.exe
3924	schtasks.exe
1976	schtasks.exe
3720	schtasks.exe
2168	schtasks.exe
396	schtasks.exe
5104	schtasks.exe
2104	schtasks.exe
1176	schtasks.exe
4360	schtasks.exe
4508	schtasks.exe
1816	schtasks.exe
1952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

pid	Process
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
5096	powershell.exe
5096	powershell.exe
1152	powershell.exe
1152	powershell.exe
1008	powershell.exe
1008	powershell.exe
4248	powershell.exe
4248	powershell.exe
5000	powershell.exe
5000	powershell.exe
3956	powershell.exe
3956	powershell.exe
3440	powershell.exe
3440	powershell.exe
4312	powershell.exe
4312	powershell.exe
4336	powershell.exe
4336	powershell.exe
1376	powershell.exe
1376	powershell.exe
4652	powershell.exe
4652	powershell.exe
4312	powershell.exe
3956	powershell.exe
3440	powershell.exe
4248	powershell.exe
5096	powershell.exe
1152	powershell.exe
5000	powershell.exe
4336	powershell.exe
1008	powershell.exe
4652	powershell.exe
1376	powershell.exe
648	winlogon.exe
1816	winlogon.exe
3440	winlogon.exe
1040	winlogon.exe
320	winlogon.exe
2996	winlogon.exe
4652	winlogon.exe
3240	winlogon.exe
2376	winlogon.exe
4732	winlogon.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeDebugPrivilege	648	winlogon.exe
Token: SeDebugPrivilege	1816	winlogon.exe
Token: SeDebugPrivilege	3440	winlogon.exe
Token: SeDebugPrivilege	1040	winlogon.exe
Token: SeDebugPrivilege	320	winlogon.exe
Token: SeDebugPrivilege	2996	winlogon.exe
Token: SeDebugPrivilege	4652	winlogon.exe
Token: SeDebugPrivilege	3240	winlogon.exe
Token: SeDebugPrivilege	2376	winlogon.exe
Token: SeDebugPrivilege	4732	winlogon.exe
Token: SeDebugPrivilege	3920	winlogon.exe
Token: SeDebugPrivilege	2404	winlogon.exe
Token: SeDebugPrivilege	1944	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exetmp7958.tmp.execmd.exewinlogon.exeWScript.exewinlogon.exetmpE62A.tmp.exeWScript.exewinlogon.exe

description	pid	Process	procid_target
PID 4964 wrote to memory of 4948	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	140
PID 4964 wrote to memory of 4948	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	140
PID 4964 wrote to memory of 4948	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	140
PID 4948 wrote to memory of 452	4948	tmp7958.tmp.exe	142
PID 4948 wrote to memory of 452	4948	tmp7958.tmp.exe	142
PID 4948 wrote to memory of 452	4948	tmp7958.tmp.exe	142
PID 4948 wrote to memory of 452	4948	tmp7958.tmp.exe	142
PID 4948 wrote to memory of 452	4948	tmp7958.tmp.exe	142
PID 4948 wrote to memory of 452	4948	tmp7958.tmp.exe	142
PID 4948 wrote to memory of 452	4948	tmp7958.tmp.exe	142
PID 4964 wrote to memory of 4652	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	147
PID 4964 wrote to memory of 4652	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	147
PID 4964 wrote to memory of 3440	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	148
PID 4964 wrote to memory of 3440	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	148
PID 4964 wrote to memory of 5096	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	149
PID 4964 wrote to memory of 5096	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	149
PID 4964 wrote to memory of 4248	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	150
PID 4964 wrote to memory of 4248	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	150
PID 4964 wrote to memory of 1376	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	151
PID 4964 wrote to memory of 1376	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	151
PID 4964 wrote to memory of 4336	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	153
PID 4964 wrote to memory of 4336	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	153
PID 4964 wrote to memory of 4312	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	154
PID 4964 wrote to memory of 4312	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	154
PID 4964 wrote to memory of 5000	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	155
PID 4964 wrote to memory of 5000	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	155
PID 4964 wrote to memory of 3956	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	156
PID 4964 wrote to memory of 3956	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	156
PID 4964 wrote to memory of 1152	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	157
PID 4964 wrote to memory of 1152	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	157
PID 4964 wrote to memory of 1008	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	158
PID 4964 wrote to memory of 1008	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	158
PID 4964 wrote to memory of 4696	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	168
PID 4964 wrote to memory of 4696	4964	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe	168
PID 4696 wrote to memory of 3444	4696	cmd.exe	171
PID 4696 wrote to memory of 3444	4696	cmd.exe	171
PID 4696 wrote to memory of 648	4696	cmd.exe	174
PID 4696 wrote to memory of 648	4696	cmd.exe	174
PID 648 wrote to memory of 4988	648	winlogon.exe	175
PID 648 wrote to memory of 4988	648	winlogon.exe	175
PID 648 wrote to memory of 4436	648	winlogon.exe	176
PID 648 wrote to memory of 4436	648	winlogon.exe	176
PID 4988 wrote to memory of 1816	4988	WScript.exe	177
PID 4988 wrote to memory of 1816	4988	WScript.exe	177
PID 1816 wrote to memory of 4248	1816	winlogon.exe	178
PID 1816 wrote to memory of 4248	1816	winlogon.exe	178
PID 1816 wrote to memory of 2472	1816	winlogon.exe	179
PID 1816 wrote to memory of 2472	1816	winlogon.exe	179
PID 1816 wrote to memory of 2256	1816	winlogon.exe	181
PID 1816 wrote to memory of 2256	1816	winlogon.exe	181
PID 1816 wrote to memory of 2256	1816	winlogon.exe	181
PID 2256 wrote to memory of 1340	2256	tmpE62A.tmp.exe	183
PID 2256 wrote to memory of 1340	2256	tmpE62A.tmp.exe	183
PID 2256 wrote to memory of 1340	2256	tmpE62A.tmp.exe	183
PID 2256 wrote to memory of 1340	2256	tmpE62A.tmp.exe	183
PID 2256 wrote to memory of 1340	2256	tmpE62A.tmp.exe	183
PID 2256 wrote to memory of 1340	2256	tmpE62A.tmp.exe	183
PID 2256 wrote to memory of 1340	2256	tmpE62A.tmp.exe	183
PID 4248 wrote to memory of 3440	4248	WScript.exe	185
PID 4248 wrote to memory of 3440	4248	WScript.exe	185
PID 3440 wrote to memory of 3664	3440	winlogon.exe	186
PID 3440 wrote to memory of 3664	3440	winlogon.exe	186
PID 3440 wrote to memory of 1104	3440	winlogon.exe	187
PID 3440 wrote to memory of 1104	3440	winlogon.exe	187

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

Processes:

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe
"C:\Users\Admin\AppData\Local\Temp\5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2N.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4964
- C:\Users\Admin\AppData\Local\Temp\tmp7958.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp7958.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Users\Admin\AppData\Local\Temp\tmp7958.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp7958.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PJAVlmCtXs.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3444
- - C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
    "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:648
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32d5b3e4-32a0-4f46-bab7-b92ba7e96d2e.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1816
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44db6630-aa4e-415d-828a-005ebeb68801.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ca81511-1862-484c-b302-b7e4a45b5fe2.vbs"
        8⤵
        
        PID:3664
        
        C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1040
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c3e7db3-af55-4014-b74e-9a93637ad4be.vbs"
        10⤵
        
        PID:3896
        
        C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:320
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\352631d1-4395-41d3-a106-ee6780b8c1b9.vbs"
        12⤵
        
        PID:4056
        
        C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6ead89ff-8776-4cdd-806a-df32fc33eec2.vbs"
        14⤵
        
        PID:4376
        
        C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e35efd0-46b9-4b09-8d80-5b0420e601ec.vbs"
        16⤵
        
        PID:1060
        
        C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3240
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee65a05a-8249-4302-9ad4-28f93b68e0dd.vbs"
        18⤵
        
        PID:4332
        
        C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\947f96e0-ec3b-4021-843c-f804c51b7abb.vbs"
        20⤵
        
        PID:3400
        
        C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b62d7440-a30a-4ba3-8a9d-4ef4f055ebd2.vbs"
        22⤵
        
        PID:1812
        
        C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3920
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a09b8abf-5676-47ef-a47c-71e401202593.vbs"
        24⤵
        
        PID:1332
        
        C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4b41bf8b-6852-4f37-bef5-63114108759c.vbs"
        26⤵
        
        PID:1516
        
        C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe"
        27⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83b70d1c-26d6-4777-8723-0e2798083b4c.vbs"
        28⤵
        
        PID:784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\daec4946-89a0-43e0-a70f-cdda3ac44731.vbs"
        28⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\tmpA88B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA88B.tmp.exe"
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\tmpA88B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA88B.tmp.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\tmpA88B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA88B.tmp.exe"
        30⤵
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34af8de9-2702-49c4-b019-44d8ef1f1109.vbs"
        26⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\tmp7749.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7749.tmp.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\tmp7749.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7749.tmp.exe"
        27⤵
        Executes dropped EXE
        
        PID:1440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69e0a801-6881-487b-95c2-6af4bd8cf9ef.vbs"
        24⤵
        
        PID:2848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1508eb76-799a-4fe8-b579-808e43d06820.vbs"
        22⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\tmp2CC3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2CC3.tmp.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\tmp2CC3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2CC3.tmp.exe"
        23⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4b187361-2027-4e8a-92f5-f7fbed4cdedd.vbs"
        20⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\tmpFCD9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFCD9.tmp.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\tmpFCD9.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFCD9.tmp.exe"
        21⤵
        Executes dropped EXE
        
        PID:1976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efe73c67-e6a9-47f9-8028-ab76e164d37e.vbs"
        18⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\tmpCD0F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCD0F.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\tmpCD0F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCD0F.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a1c4401-1cf1-41b5-9b30-9c3515e4a45e.vbs"
        16⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\tmpB06F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB06F.tmp.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\tmpB06F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB06F.tmp.exe"
        17⤵
        Executes dropped EXE
        
        PID:5004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4459cca7-3a17-42ad-b46f-b03b180b2d0c.vbs"
        14⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\tmp8076.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8076.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\tmp8076.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8076.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36125431-5b7a-48bc-82e0-53d3ee5bccf0.vbs"
        12⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\tmp4F73.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4F73.tmp.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\tmp4F73.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4F73.tmp.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\tmp4F73.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4F73.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\tmp4F73.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4F73.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:3736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb67dbd6-c16c-45d5-a7cb-3eb896f2a29d.vbs"
        10⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\tmp1E12.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1E12.tmp.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Temp\tmp1E12.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1E12.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\tmp1E12.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1E12.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a83ea32-2628-4030-8953-26ca840a8c48.vbs"
        8⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\tmp2AB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2AB.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\tmp2AB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2AB.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:2392
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d173842-3b64-4db9-8113-3e82892f9851.vbs"
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\tmpE62A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE62A.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\tmpE62A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE62A.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:1340
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\56175f1d-1686-4ef1-a58f-dfe55e54a9f9.vbs"
      4⤵
      PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\CbsTemp\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\CbsTemp\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\CbsTemp\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Temp\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Temp\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Windows\IdentityCRL\production\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\production\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\IdentityCRL\production\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Windows\Media\Quirky\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\Media\Quirky\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Windows\Media\Quirky\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\USOShared\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\USOShared\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\USOShared\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\ServiceProfiles\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\dllhost.exe

Filesize
4.9MB

MD5
2a7ccef13c3319ee428c38a7a814ed9e

SHA1
b4c3e9fe3a9f0227847b870ac5e08e718422ef89

SHA256
cf3311e5b3039fd7604974745fc551140cb8045bef433fad918c8bffafd002d4

SHA512
19bbae5c8961e9e9cfbf415cb3cc80655ca8687733f9d3e56ede300e57da4900cfe4fa99fbc0babd36eb9ae3076d407f2f9e6c321e614d82e488f2ed1d7b271f

Download Submit
C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe

Filesize
4.9MB

MD5
fbad13694fbd76b4a28785c6fa12af90

SHA1
35aca1ddefc9672625d9e94fd886810f30eea843

SHA256
5bb5b675e57095d6b0d8db6bb72107bfaa54c808d4e217511caf44540b08d4f2

SHA512
0e4ec2070b6fde55ea405611c7d8bc73520670608a6dc0e2f605c9a70c96bfa44135f988c7c1c29d20f0a1edd0390e056d9e6d6401d4a8aefee0fa96e1cb447b

Download Submit
C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe

Filesize
4.9MB

MD5
5b265238a485fb080b3c2352c6d4f954

SHA1
2af1b8eb4dcbb617b14f13e88e9c241e6ce53767

SHA256
860884d956747415abb4718505d6bf6a0f3707394089de7560b95582d383c05a

SHA512
cb08d560c648918248dbf7502d7336cd2bcc19179702b20d43a81aa0a861e1e89049d4ef78d7124dfb87e737e628720eb5e56536e50fb85ea4b7d61cd61586c8

Download Submit
C:\Recovery\WindowsRE\winlogon.exe

Filesize
4.9MB

MD5
9c793e7c2e96f42994dab4be293b99e5

SHA1
c9996e6771b753e13571a5d94a03330037bf418e

SHA256
358fc3edd347f294af9a6f53370b9b57d0b9e435f2fe34673e61f3909f99b5fa

SHA512
9d8ffa8bab4f76b35df7eea49087e095577534113e1f55cf5d8674a5170db954f6ae739f26dfed9f4e9a73be6b8d21fe7de1161150b8f4a3a14c2c0c83416cf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Temp\32d5b3e4-32a0-4f46-bab7-b92ba7e96d2e.vbs

Filesize
749B

MD5
cb28cc65b50632bbca0b5deca5a13e15

SHA1
598beac9cf18c39fdeee621e0e3f138dc68e9717

SHA256
dcdc55e7e3a9917a9333fee637344e0bf60c35ab56479a65ea1c69958f0424c2

SHA512
8d8545cff89484c4b7d22c850395244de9c625f643f12d45f1fbf984eea1f23886a3a1c33459e6e78503e3b885f7b86bbe33cf1034322aeb04f39427c547d2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\352631d1-4395-41d3-a106-ee6780b8c1b9.vbs

Filesize
749B

MD5
51b7609e555be6c2b94d0833758f9e12

SHA1
b9164749c0e2c0f981078a4aeef11521806fe5a0

SHA256
5a6545f47db08ffddc84dbcc4b03b607f3ec0bd042b1f9b4e3901a3b6bee4aed

SHA512
728676c64318aa523bac4e951af499a242b7760ef3019c7f2f543a01de3aabd834fdb8f38c9db1d883d8373bacc85030a489b6db321d4c48e9fa493458847627

Download Submit
C:\Users\Admin\AppData\Local\Temp\44db6630-aa4e-415d-828a-005ebeb68801.vbs

Filesize
750B

MD5
a4ce29124ab43235c295cf2359fbed57

SHA1
ff1be5d37ebc2785d0bf319865b4331688b4c67a

SHA256
f21374a77d3c189eb046c361a0c63d7d9a1e0c64ea49dbc445afdd063dbbff20

SHA512
1e16e8f66500d2ec163f07ee5c8450d7bfc17efa2a20c245f91ca90daeb45691786fb03375ea729a859384d4d503da35dbd55b1d5db39e4b660263b82c0e3b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ca81511-1862-484c-b302-b7e4a45b5fe2.vbs

Filesize
750B

MD5
c155dc6a703ede92787eb9d4dee30c80

SHA1
e4d1aedb4f4fa74f17cc9223248ce161e07063ad

SHA256
d9413b9b2c8a9a52617a65b646e22ce2ac22acb1429b91dbee48f2be0fa725fa

SHA512
749d8cde38bc7825633e6f738be940b61fb610ee24728e5f39a13ff766428f5c378fe42396b31c4e2ace4db117c47b06a342659c3e2977679fe9df641b1551f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\56175f1d-1686-4ef1-a58f-dfe55e54a9f9.vbs

Filesize
526B

MD5
be31d55d1512bd6a2ad1835ad078cb64

SHA1
70cce51fa98194ce68b304c25f17666d22fd096a

SHA256
4fe620d8af3db48d97451a87c93339b0a5bb867f28e2250df8d42a90c4fa63d3

SHA512
6826979e2ba4fe90262cb349f49f83da8f19200cdf5578a30b2e9785670aaae145c65ddf894c7deba903d3f57658820e636e4d10a96ef01ae218a65e38760675

Download Submit
C:\Users\Admin\AppData\Local\Temp\5c3e7db3-af55-4014-b74e-9a93637ad4be.vbs

Filesize
750B

MD5
8ff8c2025581fbbc96b6392a8fa09151

SHA1
50c99ea49e7b29446037c1dc2727fca267ec0e87

SHA256
16424c5461db504b1882e037d32d60c3973ba88be077d20b4e439a27dd30ac47

SHA512
45b1fbb5c91106e9226fd6545ef747b68fc5c3ebb1b4ac10df4dd87e4aa725a2107139448f296af2e6a5729e65677360bae194a52aaaabe3e402614064896d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e35efd0-46b9-4b09-8d80-5b0420e601ec.vbs

Filesize
750B

MD5
6a7dcb0a8980aeac9ae6d45f5d1c7f7c

SHA1
31d2e3ac0da2f950f639113b6fa96cbeca5d8a0e

SHA256
6a945c01503364b957135c22a0a03aee93d70794b3691ef3b9d2d54255977959

SHA512
53eccc45577c586a8e6576ce2e7b2bbd089090045f9b9a7edd32f7fd9ed37f5e1fceb51b6497e0eed70404ae1ea386912f335521e67b68b11fcd4b9187e3c640

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ead89ff-8776-4cdd-806a-df32fc33eec2.vbs

Filesize
750B

MD5
f204b40c06d15ee85a704ac67f9e94ad

SHA1
0784bf8d876193586098820f713aed52a2fbee18

SHA256
9d8d601aa91c117cb58a25bec546e876b81674590733983e8318ee6e9196afa0

SHA512
ddd823b1ffb89d4646f0ce34655fd84acc306525871aec7cad27e74b46f4a29370768e27eecb6a0657b0d5ef9499241e535b6251a14b9a512e08c4b6a3c5ec7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\PJAVlmCtXs.bat

Filesize
239B

MD5
4a0751dc3927f8f1c1c3c1d0a81615c5

SHA1
68e238dae8977e8a59463b0a4851b22c386edfa1

SHA256
65399477e5e79eaff8e7ec059477e3050ef29c93dc46d85cc48b84017e7cef4c

SHA512
1dca3567aa62cbd48c17d37ed887e8b1264defbf471b0563f72956b47e1f6fea245b0d9913329892abc9f840af40dded4ec9c0eb88b715765abe571972476479

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ud135xc.4sc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7958.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
memory/452-83-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1816-345-0x000000001BE00000-0x000000001BE12000-memory.dmp

Filesize
72KB

Download
memory/2404-546-0x0000000002B60000-0x0000000002B72000-memory.dmp

Filesize
72KB

Download
memory/3956-211-0x00000135FAFF0000-0x00000135FB012000-memory.dmp

Filesize
136KB

Download
memory/4964-17-0x000000001BCC0000-0x000000001BCC8000-memory.dmp

Filesize
32KB

Download
memory/4964-16-0x000000001BCB0000-0x000000001BCB8000-memory.dmp

Filesize
32KB

Download
memory/4964-205-0x00007FFA6BAC0000-0x00007FFA6C581000-memory.dmp

Filesize
10.8MB

Download
memory/4964-4-0x0000000001020000-0x000000000103C000-memory.dmp

Filesize
112KB

Download
memory/4964-151-0x00007FFA6BAC3000-0x00007FFA6BAC5000-memory.dmp

Filesize
8KB

Download
memory/4964-5-0x000000001BC40000-0x000000001BC90000-memory.dmp

Filesize
320KB

Download
memory/4964-2-0x00007FFA6BAC0000-0x00007FFA6C581000-memory.dmp

Filesize
10.8MB

Download
memory/4964-3-0x000000001B510000-0x000000001B63E000-memory.dmp

Filesize
1.2MB

Download
memory/4964-0-0x00007FFA6BAC3000-0x00007FFA6BAC5000-memory.dmp

Filesize
8KB

Download
memory/4964-6-0x0000000002840000-0x0000000002848000-memory.dmp

Filesize
32KB

Download
memory/4964-7-0x00000000028B0000-0x00000000028C0000-memory.dmp

Filesize
64KB

Download
memory/4964-165-0x00007FFA6BAC0000-0x00007FFA6C581000-memory.dmp

Filesize
10.8MB

Download
memory/4964-8-0x00000000028D0000-0x00000000028E6000-memory.dmp

Filesize
88KB

Download
memory/4964-1-0x0000000000230000-0x0000000000724000-memory.dmp

Filesize
5.0MB

Download
memory/4964-18-0x000000001BCD0000-0x000000001BCDC000-memory.dmp

Filesize
48KB

Download
memory/4964-14-0x000000001BC90000-0x000000001BC9E000-memory.dmp

Filesize
56KB

Download
memory/4964-15-0x000000001BCA0000-0x000000001BCAE000-memory.dmp

Filesize
56KB

Download
memory/4964-13-0x0000000002920000-0x000000000292A000-memory.dmp

Filesize
40KB

Download
memory/4964-12-0x000000001C1C0000-0x000000001C6E8000-memory.dmp

Filesize
5.2MB

Download
memory/4964-11-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/4964-10-0x0000000002900000-0x000000000290A000-memory.dmp

Filesize
40KB

Download
memory/4964-9-0x00000000028F0000-0x0000000002900000-memory.dmp

Filesize
64KB

Download