dcrat | 405633b7f6c5ecfa971f23dbb09e85d40224bb74c83ffdafb827b301bc413427

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\", \"C:\\Windows\\schemas\\CodeIntegrity\\dllhost.exe\", \"C:\\BrowserSvc\\unsecapp.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\", \"C:\\Windows\\schemas\\CodeIntegrity\\dllhost.exe\", \"C:\\BrowserSvc\\unsecapp.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\BrowserSvc\\w32tm.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\sysmon.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\", \"C:\\Windows\\schemas\\CodeIntegrity\\dllhost.exe\", \"C:\\BrowserSvc\\unsecapp.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\", \"C:\\Windows\\schemas\\CodeIntegrity\\dllhost.exe\", \"C:\\BrowserSvc\\unsecapp.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\", \"C:\\Windows\\schemas\\CodeIntegrity\\dllhost.exe\", \"C:\\BrowserSvc\\unsecapp.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\BrowserSvc\\w32tm.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\", \"C:\\Windows\\schemas\\CodeIntegrity\\dllhost.exe\", \"C:\\BrowserSvc\\unsecapp.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\BrowserSvc\\w32tm.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\sysmon.exe\", \"C:\\Windows\\en-US\\lsass.exe\", \"C:\\Windows\\Vss\\Writers\\backgroundTaskHost.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\", \"C:\\Windows\\schemas\\CodeIntegrity\\dllhost.exe\", \"C:\\BrowserSvc\\unsecapp.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\BrowserSvc\\w32tm.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\sysmon.exe\", \"C:\\Windows\\en-US\\lsass.exe\", \"C:\\Windows\\Vss\\Writers\\backgroundTaskHost.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\", \"C:\\Windows\\schemas\\CodeIntegrity\\dllhost.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Defender\\smss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\", \"C:\\Windows\\bcastdvr\\upfc.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\", \"C:\\Windows\\schemas\\CodeIntegrity\\dllhost.exe\", \"C:\\BrowserSvc\\unsecapp.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\BrowserSvc\\w32tm.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\sysmon.exe\", \"C:\\Windows\\en-US\\lsass.exe\""	upfc.exe.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	460	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	4624	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	4624	schtasks.exe	91

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1620	powershell.exe
3364	powershell.exe
2556	powershell.exe
2360	powershell.exe
1792	powershell.exe
4456	powershell.exe
2188	powershell.exe
2628	powershell.exe
1972	powershell.exe
3464	powershell.exe
5080	powershell.exe
5084	powershell.exe
2628	powershell.exe
3808	powershell.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1028	attrib.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	reg.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WinSFX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Checker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	msAgentreviewCommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	upfc.exe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RunShell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	upfc.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSFX.exe	java.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSFX.exe	java.exe

Executes dropped EXE 10 IoCs

pid	Process
3860	WinSFX.exe
1812	Checker.exe
1728	RunShell.exe
3384	msAgentreviewCommon.exe
1724	upfc.exe
844	upfc.exe.exe
4616	msAgentreviewCommon.exe
4496	dllhost.exe
1468	dllhost.exe.exe
3572	upfc.exe.exe

Loads dropped DLL 1 IoCs

pid	Process
2360	java.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\schemas\\CodeIntegrity\\dllhost.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\BrowserSvc\\unsecapp.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\sysmon.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Windows\\bcastdvr\\upfc.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msAgentreviewCommon = "\"C:\\BrowserSvc\\msAgentreviewCommon.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\Vss\\Writers\\backgroundTaskHost.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc.exe = "\"C:\\Windows\\bcastdvr\\upfc.exe.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msAgentreviewCommon = "\"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\w32tm = "\"C:\\BrowserSvc\\w32tm.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\en-US\\lsass.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc.exe = "\"C:\\Windows\\bcastdvr\\upfc.exe.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Defender\\smss.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\DiagTrack\\Scenarios\\dllhost.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\sysmon.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\Vss\\Writers\\backgroundTaskHost.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msAgentreviewCommon = "\"C:\\Users\\All Users\\Packages\\msAgentreviewCommon.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\schemas\\CodeIntegrity\\dllhost.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\BrowserSvc\\unsecapp.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\en-US\\lsass.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msAgentreviewCommon = "\"C:\\BrowserSvc\\msAgentreviewCommon.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\w32tm = "\"C:\\BrowserSvc\\w32tm.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\dllhost.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	upfc.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Defender\\smss.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\WindowsPowerShell\\RuntimeBroker.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Windows\\bcastdvr\\upfc.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	msAgentreviewCommon.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	java.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
27	discord.com
28	discord.com
33	discord.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	api.ipify.org
22	ip-api.com
46	ipinfo.io
47	ipinfo.io
17	api.ipify.org

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCBFF02F972CD74EE898EF1A636536A81.TMP	csc.exe
File created	\??\c:\Windows\System32\-63gkj.exe	csc.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\CSC8D1FA316F8B14EF9B820206416555E14.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\dllhost.exe	csc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\dllhost.exe	RunShell.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\5940a34987c991	RunShell.exe
File created	C:\Program Files (x86)\Windows Defender\smss.exe	RunShell.exe
File created	C:\Program Files (x86)\Windows Defender\69ddcba757bf72	RunShell.exe
File created	\??\c:\Program Files (x86)\WindowsPowerShell\CSC6218CE8863974421835BBBD1F83D71.TMP	csc.exe
File created	\??\c:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe	csc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\dllhost.exe	RunShell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe	RunShell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\9e8d7a4ca61bd9	RunShell.exe
File created	\??\c:\Program Files (x86)\Windows Defender\CSC93CD0C0977F940629D851619DF4D1525.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Windows Defender\smss.exe	csc.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\bcastdvr\ea1d8f6d871115	RunShell.exe
File created	C:\Windows\schemas\CodeIntegrity\dllhost.exe	msAgentreviewCommon.exe
File created	C:\Windows\schemas\CodeIntegrity\5940a34987c991	msAgentreviewCommon.exe
File created	C:\Windows\DiagTrack\Scenarios\dllhost.exe	msAgentreviewCommon.exe
File created	\??\c:\Windows\bcastdvr\CSCFFFE03B08079448A9BA1CD5C92A1994.TMP	csc.exe
File created	C:\Windows\bcastdvr\upfc.exe	RunShell.exe
File created	\??\c:\Windows\bcastdvr\upfc.exe	csc.exe
File created	\??\c:\Windows\schemas\CodeIntegrity\CSCCABBB2F324AF4F02B3839E43F5C6C5F2.TMP	csc.exe
File created	\??\c:\Windows\schemas\CodeIntegrity\dllhost.exe	csc.exe
File created	C:\Windows\DiagTrack\Scenarios\5940a34987c991	msAgentreviewCommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinSFX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Checker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
532	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	WinSFX.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RunShell.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	msAgentreviewCommon.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	upfc.exe.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
1812	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
532	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2000	schtasks.exe
4972	schtasks.exe
4924	schtasks.exe
2820	schtasks.exe
3916	schtasks.exe
1860	schtasks.exe
4448	schtasks.exe
3604	schtasks.exe
2292	schtasks.exe
3688	schtasks.exe
2432	schtasks.exe
1396	schtasks.exe
4824	schtasks.exe
1488	schtasks.exe
1484	schtasks.exe
1856	schtasks.exe
3228	schtasks.exe
3692	schtasks.exe
4144	schtasks.exe
4600	schtasks.exe
2144	schtasks.exe
4588	schtasks.exe
3276	schtasks.exe
3680	schtasks.exe
2872	schtasks.exe
212	schtasks.exe
2036	schtasks.exe
4340	schtasks.exe
1460	schtasks.exe
460	schtasks.exe
636	schtasks.exe
3776	schtasks.exe
4496	schtasks.exe
2000	schtasks.exe
4308	schtasks.exe
776	schtasks.exe
1432	schtasks.exe
4468	schtasks.exe
1100	schtasks.exe
1732	schtasks.exe
3368	schtasks.exe
1740	schtasks.exe
372	schtasks.exe
1956	schtasks.exe
1296	schtasks.exe
2324	schtasks.exe
1188	schtasks.exe
744	schtasks.exe
4620	schtasks.exe
3276	schtasks.exe
3604	schtasks.exe
3716	schtasks.exe
2832	schtasks.exe
684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
2360	java.exe
3364	powershell.exe
3364	powershell.exe
3364	powershell.exe
1620	powershell.exe
1620	powershell.exe
1620	powershell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe
1728	RunShell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeBackupPrivilege	2360	java.exe
Token: SeBackupPrivilege	2360	java.exe
Token: SeSecurityPrivilege	2360	java.exe
Token: SeDebugPrivilege	2360	java.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeRestorePrivilege	2360	java.exe
Token: SeDebugPrivilege	1728	RunShell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	3384	msAgentreviewCommon.exe
Token: SeDebugPrivilege	4616	msAgentreviewCommon.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	3276	backgroundTaskHost.exe
Token: SeDebugPrivilege	1468	dllhost.exe.exe
Token: SeDebugPrivilege	3572	upfc.exe.exe
Token: SeDebugPrivilege	1808	taskmgr.exe
Token: SeSystemProfilePrivilege	1808	taskmgr.exe
Token: SeCreateGlobalPrivilege	1808	taskmgr.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe

Suspicious use of SendNotifyMessage 23 IoCs

pid	Process
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe
1808	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2360	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1812	2360	java.exe	89
PID 2360 wrote to memory of 1812	2360	java.exe	89
PID 2360 wrote to memory of 1620	2360	java.exe	95
PID 2360 wrote to memory of 1620	2360	java.exe	95
PID 2360 wrote to memory of 3364	2360	java.exe	96
PID 2360 wrote to memory of 3364	2360	java.exe	96
PID 2360 wrote to memory of 3860	2360	java.exe	101
PID 2360 wrote to memory of 3860	2360	java.exe	101
PID 2360 wrote to memory of 3860	2360	java.exe	101
PID 3860 wrote to memory of 4108	3860	WinSFX.exe	102
PID 3860 wrote to memory of 4108	3860	WinSFX.exe	102
PID 3860 wrote to memory of 4108	3860	WinSFX.exe	102
PID 3860 wrote to memory of 1812	3860	WinSFX.exe	103
PID 3860 wrote to memory of 1812	3860	WinSFX.exe	103
PID 3860 wrote to memory of 1812	3860	WinSFX.exe	103
PID 2360 wrote to memory of 744	2360	java.exe	106
PID 2360 wrote to memory of 744	2360	java.exe	106
PID 744 wrote to memory of 1028	744	cmd.exe	108
PID 744 wrote to memory of 1028	744	cmd.exe	108
PID 1812 wrote to memory of 1336	1812	Checker.exe	109
PID 1812 wrote to memory of 1336	1812	Checker.exe	109
PID 1812 wrote to memory of 1336	1812	Checker.exe	109
PID 4108 wrote to memory of 4572	4108	WScript.exe	114
PID 4108 wrote to memory of 4572	4108	WScript.exe	114
PID 4108 wrote to memory of 4572	4108	WScript.exe	114
PID 4572 wrote to memory of 1728	4572	cmd.exe	116
PID 4572 wrote to memory of 1728	4572	cmd.exe	116
PID 1728 wrote to memory of 3088	1728	RunShell.exe	120
PID 1728 wrote to memory of 3088	1728	RunShell.exe	120
PID 3088 wrote to memory of 3364	3088	csc.exe	122
PID 3088 wrote to memory of 3364	3088	csc.exe	122
PID 1728 wrote to memory of 3808	1728	RunShell.exe	138
PID 1728 wrote to memory of 3808	1728	RunShell.exe	138
PID 1728 wrote to memory of 2628	1728	RunShell.exe	139
PID 1728 wrote to memory of 2628	1728	RunShell.exe	139
PID 1728 wrote to memory of 2360	1728	RunShell.exe	140
PID 1728 wrote to memory of 2360	1728	RunShell.exe	140
PID 1728 wrote to memory of 2556	1728	RunShell.exe	141
PID 1728 wrote to memory of 2556	1728	RunShell.exe	141
PID 1728 wrote to memory of 1792	1728	RunShell.exe	142
PID 1728 wrote to memory of 1792	1728	RunShell.exe	142
PID 1728 wrote to memory of 1972	1728	RunShell.exe	143
PID 1728 wrote to memory of 1972	1728	RunShell.exe	143
PID 1728 wrote to memory of 1468	1728	RunShell.exe	150
PID 1728 wrote to memory of 1468	1728	RunShell.exe	150
PID 1468 wrote to memory of 2820	1468	cmd.exe	152
PID 1468 wrote to memory of 2820	1468	cmd.exe	152
PID 1468 wrote to memory of 532	1468	cmd.exe	153
PID 1468 wrote to memory of 532	1468	cmd.exe	153
PID 1336 wrote to memory of 1864	1336	WScript.exe	155
PID 1336 wrote to memory of 1864	1336	WScript.exe	155
PID 1336 wrote to memory of 1864	1336	WScript.exe	155
PID 1864 wrote to memory of 3384	1864	cmd.exe	157
PID 1864 wrote to memory of 3384	1864	cmd.exe	157
PID 3384 wrote to memory of 3588	3384	msAgentreviewCommon.exe	161
PID 3384 wrote to memory of 3588	3384	msAgentreviewCommon.exe	161
PID 3588 wrote to memory of 3400	3588	csc.exe	163
PID 3588 wrote to memory of 3400	3588	csc.exe	163
PID 3384 wrote to memory of 4468	3384	msAgentreviewCommon.exe	164
PID 3384 wrote to memory of 4468	3384	msAgentreviewCommon.exe	164
PID 4468 wrote to memory of 4356	4468	csc.exe	166
PID 4468 wrote to memory of 4356	4468	csc.exe	166
PID 3384 wrote to memory of 716	3384	msAgentreviewCommon.exe	167
PID 3384 wrote to memory of 716	3384	msAgentreviewCommon.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1028	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jarbest-obf.jar
1⤵
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SYSTEM32\reg.exe
  reg query HKLM\HARDWARE\DESCRIPTION\System /v SystemBiosVersion
  2⤵
  - Checks BIOS information in registry
  - Modifies registry key
  PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinSFX.exe
  C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinSFX.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows\Defender\yjJlDaeiCtZ3rPY3voT8EfypAtNWVOHqwTO.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows\Defender\zHxvwMPtXsd9EflNyF6bR38DTMh313hvK806W5p8W9mTT85g.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows/Defender/RunShell.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1728
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qdalndig\qdalndig.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3088
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB594.tmp" "c:\Windows\System32\CSCBFF02F972CD74EE898EF1A636536A81.TMP"
        7⤵
        
        PID:3364
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3808
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\smss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\bcastdvr\upfc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\dllhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PhfpGtg7J6.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2820
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:532
        
        C:\Windows\bcastdvr\upfc.exe
        
        "C:\Windows\bcastdvr\upfc.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\bcastdvr\upfc.exe.exe
        
        "C:\Windows\bcastdvr\upfc.exe.exe"
        8⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:844
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zhhacwnf\zhhacwnf.cmdline"
        9⤵
        Drops file in Windows directory
        
        PID:2204
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE232.tmp" "c:\Windows\schemas\CodeIntegrity\CSCCABBB2F324AF4F02B3839E43F5C6C5F2.TMP"
        10⤵
        
        PID:3444
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qfml3qql\qfml3qql.cmdline"
        9⤵
        
        PID:1892
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE2CE.tmp" "c:\BrowserSvc\CSCE573BD44700044BB8815AD98E0BE53C9.TMP"
        10⤵
        
        PID:1956
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x1twfpz1\x1twfpz1.cmdline"
        9⤵
        
        PID:4888
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE38A.tmp" "c:\Recovery\WindowsRE\CSCD0C5AD9F3414FBB9B60142777BA4E80.TMP"
        10⤵
        
        PID:4812
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dkdgag0c\dkdgag0c.cmdline"
        9⤵
        
        PID:1452
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE416.tmp" "c:\BrowserSvc\CSC71BF786DA93F40C2A9E7598A9065AF41.TMP"
        10⤵
        
        PID:3400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\backgroundTaskHost.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\BrowserSvc\w32tm.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\sysmon.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\lsass.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\backgroundTaskHost.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\bcastdvr\upfc.exe.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nJHpk4onqZ.bat"
        9⤵
        
        PID:1948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3144
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2808
        
        C:\Windows\bcastdvr\upfc.exe.exe
        
        "C:\Windows\bcastdvr\upfc.exe.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3572
        
        C:\Users\All Users\Packages\msAgentreviewCommon.exe
        
        "C:\Users\All Users\Packages\msAgentreviewCommon.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
- - C:\Users\Admin\AppData\Roaming\Windows\Defender\Checker.exe
    "C:\Users\Admin\AppData\Roaming\Windows\Defender\Checker.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\BrowserSvc\9jir1hGrtyuZOLHcOuhj8HZKZgcsvyzwZ1xbryhIf2ZdpzOmWWf.vbe"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1336
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\BrowserSvc\O41KRElzpOO.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1864
      - C:\BrowserSvc\msAgentreviewCommon.exe
        
        "C:\BrowserSvc/msAgentreviewCommon.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2pxiedw3\2pxiedw3.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCCA6.tmp" "c:\Recovery\WindowsRE\CSC29005026BB084AA2A8BCC44D62876D.TMP"
        8⤵
        
        PID:3400
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fp5rx5os\fp5rx5os.cmdline"
        7⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD23.tmp" "c:\Program Files (x86)\Windows Defender\CSC93CD0C0977F940629D851619DF4D1525.TMP"
        8⤵
        
        PID:4356
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f4ddbsad\f4ddbsad.cmdline"
        7⤵
        Drops file in Program Files directory
        
        PID:716
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD91.tmp" "c:\Program Files (x86)\WindowsPowerShell\CSC6218CE8863974421835BBBD1F83D71.TMP"
        8⤵
        
        PID:1396
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pd0fz03v\pd0fz03v.cmdline"
        7⤵
        Drops file in Windows directory
        
        PID:1732
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE0E.tmp" "c:\Windows\bcastdvr\CSCFFFE03B08079448A9BA1CD5C92A1994.TMP"
        8⤵
        
        PID:380
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1gepkqw4\1gepkqw4.cmdline"
        7⤵
        Drops file in Program Files directory
        
        PID:3176
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE7B.tmp" "c:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\CSC8D1FA316F8B14EF9B820206416555E14.TMP"
        8⤵
        
        PID:3688
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3d4pusmw\3d4pusmw.cmdline"
        7⤵
        
        PID:744
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCEC9.tmp" "c:\Users\Admin\AppData\Roaming\Windows\Defender\CSCA29799F0EA7C44CBB1B09FF160F2301C.TMP"
        8⤵
        
        PID:1596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yL9HagX5Si.bat"
        7⤵
        
        PID:3024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4300
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1092
        
        C:\Windows\schemas\CodeIntegrity\dllhost.exe
        
        "C:\Windows\schemas\CodeIntegrity\dllhost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\schemas\CodeIntegrity\dllhost.exe.exe
        
        "C:\Windows\schemas\CodeIntegrity\dllhost.exe.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
        
        C:\Recovery\WindowsRE\backgroundTaskHost.exe
        
        "C:\Recovery\WindowsRE\backgroundTaskHost.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib "+h " "+s " C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\system32\attrib.exe
    attrib "+h " "+s " C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Windows\bcastdvr\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\bcastdvr\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Windows\bcastdvr\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShellR" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShell" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShellR" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msAgentreviewCommonm" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Packages\msAgentreviewCommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msAgentreviewCommon" /sc ONLOGON /tr "'C:\Users\All Users\Packages\msAgentreviewCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msAgentreviewCommonm" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Packages\msAgentreviewCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\DiagTrack\Scenarios\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Scenarios\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\DiagTrack\Scenarios\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\schemas\CodeIntegrity\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\schemas\CodeIntegrity\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\schemas\CodeIntegrity\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\BrowserSvc\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\BrowserSvc\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\BrowserSvc\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msAgentreviewCommonm" /sc MINUTE /mo 10 /tr "'C:\BrowserSvc\msAgentreviewCommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msAgentreviewCommon" /sc ONLOGON /tr "'C:\BrowserSvc\msAgentreviewCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msAgentreviewCommonm" /sc MINUTE /mo 11 /tr "'C:\BrowserSvc\msAgentreviewCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "w32tmw" /sc MINUTE /mo 10 /tr "'C:\BrowserSvc\w32tm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "w32tm" /sc ONLOGON /tr "'C:\BrowserSvc\w32tm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "w32tmw" /sc MINUTE /mo 7 /tr "'C:\BrowserSvc\w32tm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\en-US\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Windows\Vss\Writers\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Windows\Vss\Writers\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc.exeu" /sc MINUTE /mo 14 /tr "'C:\Windows\bcastdvr\upfc.exe.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc.exe" /sc ONLOGON /tr "'C:\Windows\bcastdvr\upfc.exe.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc.exeu" /sc MINUTE /mo 5 /tr "'C:\Windows\bcastdvr\upfc.exe.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:64

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery