colibri | 04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76d

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
Size

4.9MB
MD5

76734aa65b791419a307427a85876560
SHA1

e82c8b8b689321752d7701a34e84814ad89ab2ba
SHA256

04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76d
SHA512

300a35678adc37cf5c18e9f34e01458a457b99bd56c8be560923e23493c393e78345dcf385d7369483913b1ae4fe7848170d6661e1ce68acff3d229478e35c06
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	3620	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	3620	schtasks.exe	86

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3320-2-0x000000001B8B0000-0x000000001B9DE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2044	powershell.exe
1608	powershell.exe
2940	powershell.exe
3632	powershell.exe
3708	powershell.exe
4892	powershell.exe
4352	powershell.exe
2880	powershell.exe
4936	powershell.exe
3648	powershell.exe
4504	powershell.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe

Executes dropped EXE 40 IoCs

pid	Process
544	tmp85EC.tmp.exe
3516	tmp85EC.tmp.exe
4232	winlogon.exe
4452	tmpBC4B.tmp.exe
1012	tmpBC4B.tmp.exe
3984	tmpBC4B.tmp.exe
5116	winlogon.exe
1184	tmpED3E.tmp.exe
2984	tmpED3E.tmp.exe
768	tmpED3E.tmp.exe
4424	winlogon.exe
5052	tmp9A0.tmp.exe
5064	tmp9A0.tmp.exe
2544	winlogon.exe
2876	tmp25E2.tmp.exe
2304	tmp25E2.tmp.exe
1236	tmp25E2.tmp.exe
232	winlogon.exe
1396	tmp41F6.tmp.exe
2880	tmp41F6.tmp.exe
3580	winlogon.exe
4628	tmp5F61.tmp.exe
5064	tmp5F61.tmp.exe
2248	winlogon.exe
5104	tmp8FC8.tmp.exe
2900	tmp8FC8.tmp.exe
4996	winlogon.exe
3584	tmpABDB.tmp.exe
5116	tmpABDB.tmp.exe
4904	winlogon.exe
4672	tmpDCBF.tmp.exe
4932	tmpDCBF.tmp.exe
4228	winlogon.exe
3768	tmpF96E.tmp.exe
4552	tmpF96E.tmp.exe
724	winlogon.exe
2236	tmp2987.tmp.exe
2388	tmp2987.tmp.exe
4328	tmp2987.tmp.exe
3152	tmp2987.tmp.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 544 set thread context of 3516	544	tmp85EC.tmp.exe	143
PID 1012 set thread context of 3984	1012	tmpBC4B.tmp.exe	172
PID 2984 set thread context of 768	2984	tmpED3E.tmp.exe	180
PID 5052 set thread context of 5064	5052	tmp9A0.tmp.exe	187
PID 2304 set thread context of 1236	2304	tmp25E2.tmp.exe	194
PID 1396 set thread context of 2880	1396	tmp41F6.tmp.exe	200
PID 4628 set thread context of 5064	4628	tmp5F61.tmp.exe	206
PID 5104 set thread context of 2900	5104	tmp8FC8.tmp.exe	212
PID 3584 set thread context of 5116	3584	tmpABDB.tmp.exe	218
PID 4672 set thread context of 4932	4672	tmpDCBF.tmp.exe	224
PID 3768 set thread context of 4552	3768	tmpF96E.tmp.exe	230
PID 4328 set thread context of 3152	4328	tmp2987.tmp.exe	238

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\smss.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\dllhost.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\56085415360792	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\29c1c3cc0f7685	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files\Windows Multimedia Platform\winlogon.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files\Java\jre-1.8\smss.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\winlogon.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXA2A9.tmp	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files\Windows Multimedia Platform\cc11b995f2a76d	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\unsecapp.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCX96EC.tmp	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\wininit.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\unsecapp.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\7a0fd90576e088	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RCX857E.tmp	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCX94D8.tmp	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\explorer.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\wininit.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files\Java\jre-1.8\69ddcba757bf72	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\explorer.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files\VideoLAN\VLC\56085415360792	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files (x86)\Windows Defender\5940a34987c991	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files\VideoLAN\VLC\wininit.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX89D6.tmp	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\wininit.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files\Java\jre-1.8\RCX9256.tmp	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Program Files (x86)\Windows Defender\dllhost.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\RCX9900.tmp	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ShellExperiences\RCX9042.tmp	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Windows\ShellExperiences\sppsvc.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Windows\es-ES\RCX8BEA.tmp	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\Videos\RuntimeBroker.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Windows\ShellExperiences\0a1fd5f707cd16	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Windows\tracing\9e8d7a4ca61bd9	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Windows\ServiceProfiles\LocalService\Videos\9e8d7a4ca61bd9	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Windows\tracing\RuntimeBroker.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Windows\tracing\RCXA52A.tmp	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\Videos\RCXA953.tmp	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Windows\es-ES\7a0fd90576e088	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Windows\ShellExperiences\sppsvc.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Windows\LanguageOverlayCache\services.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Windows\tracing\RuntimeBroker.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Windows\es-ES\explorer.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File created	C:\Windows\ServiceProfiles\LocalService\Videos\RuntimeBroker.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
File opened for modification	C:\Windows\es-ES\explorer.exe	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2987.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBC4B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBC4B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpED3E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9A0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp25E2.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpABDB.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF96E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2987.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp85EC.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpED3E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8FC8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDCBF.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2987.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp25E2.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp41F6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5F61.tmp.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	winlogon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1992	schtasks.exe
5068	schtasks.exe
2308	schtasks.exe
3492	schtasks.exe
1876	schtasks.exe
2172	schtasks.exe
1968	schtasks.exe
3024	schtasks.exe
704	schtasks.exe
4776	schtasks.exe
4048	schtasks.exe
4424	schtasks.exe
372	schtasks.exe
1652	schtasks.exe
3140	schtasks.exe
1984	schtasks.exe
3232	schtasks.exe
4556	schtasks.exe
1032	schtasks.exe
540	schtasks.exe
4228	schtasks.exe
4176	schtasks.exe
2376	schtasks.exe
1824	schtasks.exe
2372	schtasks.exe
3876	schtasks.exe
5040	schtasks.exe
4748	schtasks.exe
5084	schtasks.exe
4668	schtasks.exe
1044	schtasks.exe
2348	schtasks.exe
3772	schtasks.exe
3992	schtasks.exe
2392	schtasks.exe
1236	schtasks.exe
2796	schtasks.exe
2332	schtasks.exe
3328	schtasks.exe
2196	schtasks.exe
2736	schtasks.exe
5048	schtasks.exe
2060	schtasks.exe
2068	schtasks.exe
2292	schtasks.exe
3504	schtasks.exe
4360	schtasks.exe
868	schtasks.exe
3244	schtasks.exe
3596	schtasks.exe
472	schtasks.exe
1164	schtasks.exe
3300	schtasks.exe
2916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
3708	powershell.exe
3708	powershell.exe
2044	powershell.exe
2044	powershell.exe
4936	powershell.exe
4936	powershell.exe
3648	powershell.exe
3648	powershell.exe
1608	powershell.exe
1608	powershell.exe
3632	powershell.exe
3632	powershell.exe
2940	powershell.exe
2940	powershell.exe
4504	powershell.exe
4504	powershell.exe
4352	powershell.exe
4352	powershell.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
4892	powershell.exe
4892	powershell.exe
3708	powershell.exe
3708	powershell.exe
4936	powershell.exe
4892	powershell.exe
1608	powershell.exe
3648	powershell.exe
2044	powershell.exe
3632	powershell.exe
4504	powershell.exe
4352	powershell.exe
2940	powershell.exe
4232	winlogon.exe
5116	winlogon.exe
4424	winlogon.exe
2544	winlogon.exe
232	winlogon.exe
3580	winlogon.exe
2248	winlogon.exe
4996	winlogon.exe
4904	winlogon.exe
4228	winlogon.exe
724	winlogon.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4232	winlogon.exe
Token: SeDebugPrivilege	5116	winlogon.exe
Token: SeDebugPrivilege	4424	winlogon.exe
Token: SeDebugPrivilege	2544	winlogon.exe
Token: SeDebugPrivilege	232	winlogon.exe
Token: SeDebugPrivilege	3580	winlogon.exe
Token: SeDebugPrivilege	2248	winlogon.exe
Token: SeDebugPrivilege	4996	winlogon.exe
Token: SeDebugPrivilege	4904	winlogon.exe
Token: SeDebugPrivilege	4228	winlogon.exe
Token: SeDebugPrivilege	724	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 544	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	141
PID 3320 wrote to memory of 544	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	141
PID 3320 wrote to memory of 544	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	141
PID 544 wrote to memory of 3516	544	tmp85EC.tmp.exe	143
PID 544 wrote to memory of 3516	544	tmp85EC.tmp.exe	143
PID 544 wrote to memory of 3516	544	tmp85EC.tmp.exe	143
PID 544 wrote to memory of 3516	544	tmp85EC.tmp.exe	143
PID 544 wrote to memory of 3516	544	tmp85EC.tmp.exe	143
PID 544 wrote to memory of 3516	544	tmp85EC.tmp.exe	143
PID 544 wrote to memory of 3516	544	tmp85EC.tmp.exe	143
PID 3320 wrote to memory of 4892	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	144
PID 3320 wrote to memory of 4892	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	144
PID 3320 wrote to memory of 3708	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	145
PID 3320 wrote to memory of 3708	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	145
PID 3320 wrote to memory of 3648	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	146
PID 3320 wrote to memory of 3648	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	146
PID 3320 wrote to memory of 4936	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	147
PID 3320 wrote to memory of 4936	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	147
PID 3320 wrote to memory of 3632	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	148
PID 3320 wrote to memory of 3632	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	148
PID 3320 wrote to memory of 2940	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	149
PID 3320 wrote to memory of 2940	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	149
PID 3320 wrote to memory of 2880	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	150
PID 3320 wrote to memory of 2880	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	150
PID 3320 wrote to memory of 4504	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	151
PID 3320 wrote to memory of 4504	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	151
PID 3320 wrote to memory of 1608	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	152
PID 3320 wrote to memory of 1608	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	152
PID 3320 wrote to memory of 2044	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	153
PID 3320 wrote to memory of 2044	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	153
PID 3320 wrote to memory of 4352	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	154
PID 3320 wrote to memory of 4352	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	154
PID 3320 wrote to memory of 4232	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	166
PID 3320 wrote to memory of 4232	3320	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe	166
PID 4232 wrote to memory of 2348	4232	winlogon.exe	167
PID 4232 wrote to memory of 2348	4232	winlogon.exe	167
PID 4232 wrote to memory of 1724	4232	winlogon.exe	168
PID 4232 wrote to memory of 1724	4232	winlogon.exe	168
PID 4232 wrote to memory of 4452	4232	winlogon.exe	169
PID 4232 wrote to memory of 4452	4232	winlogon.exe	169
PID 4232 wrote to memory of 4452	4232	winlogon.exe	169
PID 4452 wrote to memory of 1012	4452	tmpBC4B.tmp.exe	171
PID 4452 wrote to memory of 1012	4452	tmpBC4B.tmp.exe	171
PID 4452 wrote to memory of 1012	4452	tmpBC4B.tmp.exe	171
PID 1012 wrote to memory of 3984	1012	tmpBC4B.tmp.exe	172
PID 1012 wrote to memory of 3984	1012	tmpBC4B.tmp.exe	172
PID 1012 wrote to memory of 3984	1012	tmpBC4B.tmp.exe	172
PID 1012 wrote to memory of 3984	1012	tmpBC4B.tmp.exe	172
PID 1012 wrote to memory of 3984	1012	tmpBC4B.tmp.exe	172
PID 1012 wrote to memory of 3984	1012	tmpBC4B.tmp.exe	172
PID 1012 wrote to memory of 3984	1012	tmpBC4B.tmp.exe	172
PID 2348 wrote to memory of 5116	2348	WScript.exe	173
PID 2348 wrote to memory of 5116	2348	WScript.exe	173
PID 5116 wrote to memory of 900	5116	winlogon.exe	174
PID 5116 wrote to memory of 900	5116	winlogon.exe	174
PID 5116 wrote to memory of 1784	5116	winlogon.exe	175
PID 5116 wrote to memory of 1784	5116	winlogon.exe	175
PID 5116 wrote to memory of 1184	5116	winlogon.exe	176
PID 5116 wrote to memory of 1184	5116	winlogon.exe	176
PID 5116 wrote to memory of 1184	5116	winlogon.exe	176
PID 1184 wrote to memory of 2984	1184	tmpED3E.tmp.exe	179
PID 1184 wrote to memory of 2984	1184	tmpED3E.tmp.exe	179
PID 1184 wrote to memory of 2984	1184	tmpED3E.tmp.exe	179
PID 2984 wrote to memory of 768	2984	tmpED3E.tmp.exe	180

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe
"C:\Users\Admin\AppData\Local\Temp\04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76dN.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3320
- C:\Users\Admin\AppData\Local\Temp\tmp85EC.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp85EC.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Users\Admin\AppData\Local\Temp\tmp85EC.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp85EC.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:3516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Program Files\Windows Multimedia Platform\winlogon.exe
  "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4232
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2fda1d6e-f567-4202-9e0d-2136dc499c5f.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Program Files\Windows Multimedia Platform\winlogon.exe
      "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5116
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10f754ca-aeb2-4cb7-9cca-dd3a6a60938d.vbs"
        5⤵
        
        PID:900
      - C:\Program Files\Windows Multimedia Platform\winlogon.exe
        
        "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8b69c27-ad67-4f7f-88aa-13ad94a99d76.vbs"
        7⤵
        
        PID:3328
        
        C:\Program Files\Windows Multimedia Platform\winlogon.exe
        
        "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fec3469c-0284-498f-a306-a97f5a66252b.vbs"
        9⤵
        
        PID:4744
        
        C:\Program Files\Windows Multimedia Platform\winlogon.exe
        
        "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2716147-4d92-42d3-9301-a85118e2968f.vbs"
        11⤵
        
        PID:3648
        
        C:\Program Files\Windows Multimedia Platform\winlogon.exe
        
        "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3580
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a73143e-175a-4831-86c0-b3a2005e5343.vbs"
        13⤵
        
        PID:2060
        
        C:\Program Files\Windows Multimedia Platform\winlogon.exe
        
        "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4dbe49b-2368-488c-ad20-693208cf07df.vbs"
        15⤵
        
        PID:4452
        
        C:\Program Files\Windows Multimedia Platform\winlogon.exe
        
        "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc820d71-357c-45c5-a504-764934be0769.vbs"
        17⤵
        
        PID:4012
        
        C:\Program Files\Windows Multimedia Platform\winlogon.exe
        
        "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c51ee772-56d6-40ba-9e6a-89729ed5af69.vbs"
        19⤵
        
        PID:1968
        
        C:\Program Files\Windows Multimedia Platform\winlogon.exe
        
        "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d5c2522-f4c2-4143-ab72-c18ab7138723.vbs"
        21⤵
        
        PID:1644
        
        C:\Program Files\Windows Multimedia Platform\winlogon.exe
        
        "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20bf8224-1d92-4280-a3c1-53b5e4d6ee5d.vbs"
        23⤵
        
        PID:3124
        
        C:\Program Files\Windows Multimedia Platform\winlogon.exe
        
        "C:\Program Files\Windows Multimedia Platform\winlogon.exe"
        24⤵
        
        PID:4668
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42bc094a-e3c9-4498-9f65-5b1249ec7155.vbs"
        23⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\tmp2987.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2987.tmp.exe"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\tmp2987.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2987.tmp.exe"
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\tmp2987.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2987.tmp.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\tmp2987.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2987.tmp.exe"
        26⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c174bf5-151c-40f2-8d7c-e3af6b186020.vbs"
        21⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\tmpF96E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF96E.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\tmpF96E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF96E.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:4552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab98f244-c176-4ac6-96f8-4b9f55c55b13.vbs"
        19⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\tmpDCBF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDCBF.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\tmpDCBF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDCBF.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08beadc6-f61b-47dc-a6ed-b692c1fca216.vbs"
        17⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\tmpABDB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpABDB.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\tmpABDB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpABDB.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b0c29fa-e384-40db-beb9-b4c40582d1df.vbs"
        15⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\tmp8FC8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8FC8.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\tmp8FC8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8FC8.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:2900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71e168c9-862a-490d-bf55-40a79ab5ccad.vbs"
        13⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\tmp5F61.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5F61.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\tmp5F61.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5F61.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0bbfb372-1ff9-4dba-a8be-68124b775412.vbs"
        11⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\tmp41F6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp41F6.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\tmp41F6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp41F6.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:2880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be977e09-f717-49d8-bc81-3f9a0cd37bb6.vbs"
        9⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\tmp25E2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp25E2.tmp.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\tmp25E2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp25E2.tmp.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\tmp25E2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp25E2.tmp.exe"
        11⤵
        Executes dropped EXE
        
        PID:1236
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99a90e11-aa50-49f8-808a-f854033b7f34.vbs"
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\tmp9A0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9A0.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\tmp9A0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9A0.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:5064
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75187c4e-0ead-40cb-a2cc-26741a95eada.vbs"
        5⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\tmpED3E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpED3E.tmp.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\tmpED3E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpED3E.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\tmpED3E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpED3E.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:768
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa3a8483-329d-4999-84eb-d93a866616fe.vbs"
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\tmpBC4B.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpBC4B.tmp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\tmpBC4B.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpBC4B.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\tmpBC4B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBC4B.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\setup\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\es-ES\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellExperiences\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\ShellExperiences\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jre-1.8\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre-1.8\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\tracing\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\tracing\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\tracing\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\ServiceProfiles\LocalService\Videos\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\LocalService\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\LocalService\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\VideoLAN\VLC\wininit.exe

Filesize
4.9MB

MD5
cbc2f94a3d91f8b74b5325a220d32a9d

SHA1
d848122bf9b9f45b5377ef4c195a7314f67da92b

SHA256
8cc38859fe314cc900e3d07c500638c3482ee2a6f2fd2c6dc8dccb0bc36e55b8

SHA512
5c3049f42c15e009347a658ee7962e0ca3a34a56691d4f151c20531700735b05d64ca597f6f61cb7f80e3847e96eb7551126b8899d9aa437e26ac25192c58383

Download Submit
C:\Program Files\Windows Multimedia Platform\RCX96EC.tmp

Filesize
4.9MB

MD5
1e7d61176b102d174d18e1bd44191bed

SHA1
742261164fddd7fdce083e0574a5ca44a9bfb4f7

SHA256
c7304267d2ab44798551296a7c1630dfdc5213e3154858567925a257ca0a9d94

SHA512
6a79ca6802bbfa70b570129684860ca15fc9ed1640e9a64ab6a6280cca4d83d120072ed4f514c03c7bf48beefd36e2755968d9bc32e9bd3a07b21ced01426825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\10f754ca-aeb2-4cb7-9cca-dd3a6a60938d.vbs

Filesize
733B

MD5
6ecfa2abc22137ae51c8abfdd6aae364

SHA1
c4d4d1426a214a7ba7f30629e0bc962b2d77555d

SHA256
9b96fb22896a52c006bb0a307dbead8d7961f104fee537ceb2acb16f4bacfcf1

SHA512
7b172f24025d6542c51b8693222b85ebb19357f92ead5641b222510d59f215fcf6188264ee6c3fd6e26996728b2d475818a37eae3bdb2839a04f1171dd55679d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2fda1d6e-f567-4202-9e0d-2136dc499c5f.vbs

Filesize
733B

MD5
a4306d576afd8641ed7b828895441171

SHA1
8be688f30aa482f8587a35d427c97e611d270bc3

SHA256
0afe58aca423f06c5fa1243e7b294fe3596c57620748a1ecf4356298ea5789c8

SHA512
ad70850cf132a9143a6a98f6ea9306f4b9c4dec658293696b0cc2edc0fd1d927e790fdc05b3dd5182e942cf0b26b5128283d876afba9da5f63cd898203b8b1a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\6a73143e-175a-4831-86c0-b3a2005e5343.vbs

Filesize
733B

MD5
9f68e1e9adb1ab6906a9d18b37fb3c98

SHA1
aebec0703ac85da2e5d0260de39f2f46abdce287

SHA256
c888b70fe2e857f84619847e6cd73b835606c114587dcbb1c3e06d71e7f38603

SHA512
7a82b90a3c680328d4cdd914a1c6c5d52639f2672ae133a4d463e4e52f61f50e0a90fb7d4f5a822819659c667ddb61eb8dd8fe3c04fb234d030eef7fa0bedba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0zgmmhp0.aod.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa3a8483-329d-4999-84eb-d93a866616fe.vbs

Filesize
509B

MD5
2fc6f24db261b05d2cab2bb923232b4c

SHA1
9cfe83a61defbdf20f227b535483674e29a33018

SHA256
fb35ab1c7db928f64dae278b50c3b1ea02777eefbb9161c77b07a7f91910486a

SHA512
22abe3a33ee69cf301515e3e24828a9e481189e474d50a68377d8677b06b3e48fac10c4ccd816b0357eb7d1fc3d3344270bbbe357e9dc8f073014e722a8ce8a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\b2716147-4d92-42d3-9301-a85118e2968f.vbs

Filesize
732B

MD5
c11f929b28b7a7415fa3d14082897af7

SHA1
bdb8d16091f325ce2d9ea8706987f4d1338004cc

SHA256
b9e5ed2c61090e92fcb1900b08ce28438bc01147723643afbd1fc8f3bd194adb

SHA512
62590aa21d21fc9ee683f28a059f075c20dc7bbe54b6ca2af30824328673aff1c226bbd304ce52831a1d8a095dd8d51536156397286ec6f032361893af338f78

Download Submit
C:\Users\Admin\AppData\Local\Temp\c8b69c27-ad67-4f7f-88aa-13ad94a99d76.vbs

Filesize
733B

MD5
249e2e72b067569b5dd2062a4025b812

SHA1
4a9587b5448f9fab346605e0bb92e61bfe2c08b2

SHA256
68761ba2037e173204fc7551241a754b10b39ead60c8865b877052dea084b20a

SHA512
7d85c523925648f968e473159bd1755dcebda1ad22b690777c270154bc665440d1d7f6b6249b3ceac5585958cc1c66e7e78d842711013478fc731cb9d6a24368

Download Submit
C:\Users\Admin\AppData\Local\Temp\f4dbe49b-2368-488c-ad20-693208cf07df.vbs

Filesize
733B

MD5
bca7480390a42d735642bb93e17f77f1

SHA1
fa85434fe8b34b3a2244d2a8ec0909e51abcf171

SHA256
1d38405209c241f6604f5dbfb4d02e550cac9f23286d84a0bebfe06495b7dfe1

SHA512
519ac3537a9b2181ee096d5e875bfd76bdefe1dd4a2ef9fd43f32a7a020307060e2e7fae8d5c46335dec192a31b745f41066d4ef2ad65bf86cebaff8ba69b652

Download Submit
C:\Users\Admin\AppData\Local\Temp\fec3469c-0284-498f-a306-a97f5a66252b.vbs

Filesize
733B

MD5
e371cc682b14119ce54104c2ba4d925e

SHA1
828b174259c46e3485b3ab86c06f155ec42139a3

SHA256
36566d2ed5a8fc4d8b534ff85da8dd6b5f0f5cfaa721a8e706db72600a311832

SHA512
8f4b5efb93d05d57b5da9ea5803750661a008ce883378f31402f983a62a9b8a17acd9d99e6fc17e61d1736c4c02d97200f77478db24e79ea6f9df674f754b82f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp85EC.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Windows\es-ES\explorer.exe

Filesize
4.9MB

MD5
76734aa65b791419a307427a85876560

SHA1
e82c8b8b689321752d7701a34e84814ad89ab2ba

SHA256
04449cf3ce402b23a2dede3bc5ea772edb2e4663e0005c8433ec79968699d76d

SHA512
300a35678adc37cf5c18e9f34e01458a457b99bd56c8be560923e23493c393e78345dcf385d7369483913b1ae4fe7848170d6661e1ce68acff3d229478e35c06

Download Submit
memory/3320-1-0x00000000005F0000-0x0000000000AE4000-memory.dmp

Filesize
5.0MB

Download
memory/3320-2-0x000000001B8B0000-0x000000001B9DE000-memory.dmp

Filesize
1.2MB

Download
memory/3320-14-0x000000001C050000-0x000000001C05E000-memory.dmp

Filesize
56KB

Download
memory/3320-5-0x000000001BFF0000-0x000000001C040000-memory.dmp

Filesize
320KB

Download
memory/3320-153-0x00007FFF703D3000-0x00007FFF703D5000-memory.dmp

Filesize
8KB

Download
memory/3320-164-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

Filesize
10.8MB

Download
memory/3320-6-0x00000000011E0000-0x00000000011E8000-memory.dmp

Filesize
32KB

Download
memory/3320-12-0x000000001C570000-0x000000001CA98000-memory.dmp

Filesize
5.2MB

Download
memory/3320-9-0x000000001B770000-0x000000001B780000-memory.dmp

Filesize
64KB

Download
memory/3320-352-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

Filesize
10.8MB

Download
memory/3320-7-0x0000000002E30000-0x0000000002E40000-memory.dmp

Filesize
64KB

Download
memory/3320-4-0x0000000002E10000-0x0000000002E2C000-memory.dmp

Filesize
112KB

Download
memory/3320-3-0x00007FFF703D0000-0x00007FFF70E91000-memory.dmp

Filesize
10.8MB

Download
memory/3320-16-0x000000001C070000-0x000000001C078000-memory.dmp

Filesize
32KB

Download
memory/3320-0-0x00007FFF703D3000-0x00007FFF703D5000-memory.dmp

Filesize
8KB

Download
memory/3320-15-0x000000001C060000-0x000000001C06E000-memory.dmp

Filesize
56KB

Download
memory/3320-8-0x000000001B750000-0x000000001B766000-memory.dmp

Filesize
88KB

Download
memory/3320-11-0x000000001B790000-0x000000001B7A2000-memory.dmp

Filesize
72KB

Download
memory/3320-13-0x000000001C040000-0x000000001C04A000-memory.dmp

Filesize
40KB

Download
memory/3320-18-0x000000001C090000-0x000000001C09C000-memory.dmp

Filesize
48KB

Download
memory/3320-10-0x000000001B780000-0x000000001B78A000-memory.dmp

Filesize
40KB

Download
memory/3320-17-0x000000001C080000-0x000000001C088000-memory.dmp

Filesize
32KB

Download
memory/3516-81-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3708-248-0x000001FF60130000-0x000001FF60152000-memory.dmp

Filesize
136KB

Download
memory/4228-577-0x0000000003670000-0x0000000003682000-memory.dmp

Filesize
72KB

Download
memory/4232-355-0x000000001BF70000-0x000000001BF82000-memory.dmp

Filesize
72KB

Download
memory/5116-404-0x000000001B620000-0x000000001B632000-memory.dmp

Filesize
72KB

Download