Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2024 04:57
Static task
static1
Behavioral task
behavioral1
Sample
4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe
Resource
win7-20240903-en
General
-
Target
4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe
-
Size
4.9MB
-
MD5
6e7923159a06c48bb09a81080d2d8266
-
SHA1
a2126afd2d75f3dedb602fd7f63b9940e0b47c22
-
SHA256
4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14
-
SHA512
d2ddd13c739e92febab2685f393aeed15140c4b03d3c15ec49c86bac764ab6e3a01982a64118bd9d4e700161b85e1a7f3a91f904322ecc17d6253174a08f4365
-
SSDEEP
49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 54 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2772 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4548 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 868 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3484 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3060 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4884 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1744 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2432 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2056 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4584 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4428 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2424 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4484 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3552 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 400 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4616 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1464 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4000 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3224 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1468 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4544 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4988 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4256 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2892 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3204 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1912 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3076 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4764 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4180 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4740 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1848 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4140 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2388 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 936 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2524 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4368 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1256 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2148 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2272 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4064 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4024 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4336 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3728 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4672 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4624 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5092 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 952 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2592 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1828 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3720 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1596 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3448 2756 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4392 2756 schtasks.exe 83 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe -
resource yara_rule behavioral2/memory/3216-3-0x000000001BDF0000-0x000000001BF1E000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4496 powershell.exe 3452 powershell.exe 396 powershell.exe 3292 powershell.exe 5040 powershell.exe 3560 powershell.exe 4036 powershell.exe 2400 powershell.exe 3012 powershell.exe 3276 powershell.exe 4972 powershell.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Registry.exe -
Executes dropped EXE 45 IoCs
pid Process 2908 tmpB603.tmp.exe 3692 tmpB603.tmp.exe 1712 Registry.exe 820 tmp4AE.tmp.exe 684 tmp4AE.tmp.exe 1692 Registry.exe 4224 tmp2342.tmp.exe 2128 tmp2342.tmp.exe 3412 Registry.exe 4588 tmp410B.tmp.exe 4472 tmp410B.tmp.exe 2056 tmp410B.tmp.exe 5036 Registry.exe 3276 tmp5EC5.tmp.exe 4228 tmp5EC5.tmp.exe 3748 Registry.exe 4856 tmp7D49.tmp.exe 1072 tmp7D49.tmp.exe 4704 tmp7D49.tmp.exe 2948 Registry.exe 740 tmpB10B.tmp.exe 4336 tmpB10B.tmp.exe 4908 Registry.exe 4768 tmpD116.tmp.exe 5044 tmpD116.tmp.exe 3920 tmpD116.tmp.exe 4220 Registry.exe 4292 tmp313.tmp.exe 4200 tmp313.tmp.exe 4836 Registry.exe 4276 tmp354F.tmp.exe 4492 tmp354F.tmp.exe 3236 Registry.exe 4228 tmp67F7.tmp.exe 1468 tmp67F7.tmp.exe 3412 tmp67F7.tmp.exe 636 tmp67F7.tmp.exe 3360 tmp67F7.tmp.exe 4000 Registry.exe 4456 tmp9A04.tmp.exe 2388 tmp9A04.tmp.exe 5004 Registry.exe 3428 Registry.exe 452 tmpD2C7.tmp.exe 2500 tmpD2C7.tmp.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe -
Suspicious use of SetThreadContext 13 IoCs
description pid Process procid_target PID 2908 set thread context of 3692 2908 tmpB603.tmp.exe 142 PID 820 set thread context of 684 820 tmp4AE.tmp.exe 185 PID 4224 set thread context of 2128 4224 tmp2342.tmp.exe 197 PID 4472 set thread context of 2056 4472 tmp410B.tmp.exe 207 PID 3276 set thread context of 4228 3276 tmp5EC5.tmp.exe 217 PID 1072 set thread context of 4704 1072 tmp7D49.tmp.exe 227 PID 740 set thread context of 4336 740 tmpB10B.tmp.exe 236 PID 5044 set thread context of 3920 5044 tmpD116.tmp.exe 246 PID 4292 set thread context of 4200 4292 tmp313.tmp.exe 256 PID 4276 set thread context of 4492 4276 tmp354F.tmp.exe 265 PID 636 set thread context of 3360 636 tmp67F7.tmp.exe 277 PID 4456 set thread context of 2388 4456 tmp9A04.tmp.exe 287 PID 452 set thread context of 2500 452 tmpD2C7.tmp.exe 303 -
Drops file in Program Files directory 28 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Defender\f3b6ecef712a24 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files\Common Files\fontdrvhost.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files\Mozilla Firefox\fonts\ee2ad38f3d4382 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files\Windows NT\TableTextService\en-US\RCXCCF0.tmp 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\SearchApp.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files\Windows NT\TableTextService\en-US\886983d96e3d3e 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files\Mozilla Firefox\defaults\SearchApp.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files (x86)\Windows Defender\RCXB99E.tmp 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files\Common Files\RCXC6C4.tmp 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files (x86)\Windows Multimedia Platform\ee2ad38f3d4382 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXBDD7.tmp 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\RCXD5DD.tmp 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\SearchApp.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files (x86)\Windows Defender\spoolsv.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\SearchApp.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\Registry.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\RCXDC87.tmp 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\38384e6a620884 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files\Mozilla Firefox\defaults\38384e6a620884 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files\Common Files\5b884080fd4f94 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files\Common Files\fontdrvhost.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Program Files\Mozilla Firefox\fonts\Registry.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files (x86)\Windows Defender\spoolsv.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\RCXD1B5.tmp 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\ShellExperiences\RCXC4B0.tmp 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Windows\TAPI\RCXD3C9.tmp 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Windows\TAPI\csrss.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Windows\es-ES\winlogon.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Windows\ShellExperiences\taskhostw.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Windows\TAPI\csrss.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Windows\es-ES\RCXBFFA.tmp 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Windows\es-ES\winlogon.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Windows\es-ES\cc11b995f2a76d 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Windows\ShellExperiences\ea9f0e6c9e2dcd 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File created C:\Windows\TAPI\886983d96e3d3e 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe File opened for modification C:\Windows\ShellExperiences\taskhostw.exe 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp4AE.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp2342.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp410B.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp67F7.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp67F7.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp354F.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp67F7.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp67F7.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpB603.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp5EC5.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpD116.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp313.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp9A04.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp410B.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp7D49.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp7D49.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpB10B.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpD116.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpD2C7.tmp.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings Registry.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4428 schtasks.exe 868 schtasks.exe 2272 schtasks.exe 4672 schtasks.exe 4624 schtasks.exe 2148 schtasks.exe 4884 schtasks.exe 4024 schtasks.exe 1828 schtasks.exe 4484 schtasks.exe 4584 schtasks.exe 2892 schtasks.exe 1744 schtasks.exe 3204 schtasks.exe 1848 schtasks.exe 5092 schtasks.exe 1468 schtasks.exe 3552 schtasks.exe 400 schtasks.exe 4544 schtasks.exe 4180 schtasks.exe 2388 schtasks.exe 2424 schtasks.exe 4988 schtasks.exe 1912 schtasks.exe 1256 schtasks.exe 4392 schtasks.exe 3484 schtasks.exe 4548 schtasks.exe 2412 schtasks.exe 952 schtasks.exe 1596 schtasks.exe 2772 schtasks.exe 2432 schtasks.exe 2056 schtasks.exe 4140 schtasks.exe 936 schtasks.exe 2524 schtasks.exe 4368 schtasks.exe 2592 schtasks.exe 4740 schtasks.exe 1464 schtasks.exe 3076 schtasks.exe 3720 schtasks.exe 3448 schtasks.exe 4616 schtasks.exe 4256 schtasks.exe 4064 schtasks.exe 4764 schtasks.exe 4000 schtasks.exe 3224 schtasks.exe 3728 schtasks.exe 4336 schtasks.exe 3060 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 3012 powershell.exe 3012 powershell.exe 2400 powershell.exe 2400 powershell.exe 3292 powershell.exe 3292 powershell.exe 3452 powershell.exe 3452 powershell.exe 5040 powershell.exe 5040 powershell.exe 4036 powershell.exe 4036 powershell.exe 4972 powershell.exe 4972 powershell.exe 3276 powershell.exe 3276 powershell.exe 3560 powershell.exe 3560 powershell.exe 4496 powershell.exe 4496 powershell.exe 396 powershell.exe 396 powershell.exe 396 powershell.exe 4496 powershell.exe 2400 powershell.exe 3012 powershell.exe 4036 powershell.exe 4972 powershell.exe 5040 powershell.exe 3292 powershell.exe 3452 powershell.exe 3276 powershell.exe 3560 powershell.exe 1712 Registry.exe 1692 Registry.exe 3412 Registry.exe 5036 Registry.exe 3748 Registry.exe 2948 Registry.exe 4908 Registry.exe 4220 Registry.exe 4836 Registry.exe 3236 Registry.exe 4000 Registry.exe 5004 Registry.exe 3428 Registry.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe Token: SeDebugPrivilege 3012 powershell.exe Token: SeDebugPrivilege 2400 powershell.exe Token: SeDebugPrivilege 3292 powershell.exe Token: SeDebugPrivilege 3452 powershell.exe Token: SeDebugPrivilege 5040 powershell.exe Token: SeDebugPrivilege 4036 powershell.exe Token: SeDebugPrivilege 4972 powershell.exe Token: SeDebugPrivilege 3276 powershell.exe Token: SeDebugPrivilege 3560 powershell.exe Token: SeDebugPrivilege 396 powershell.exe Token: SeDebugPrivilege 4496 powershell.exe Token: SeDebugPrivilege 1712 Registry.exe Token: SeDebugPrivilege 1692 Registry.exe Token: SeDebugPrivilege 3412 Registry.exe Token: SeDebugPrivilege 5036 Registry.exe Token: SeDebugPrivilege 3748 Registry.exe Token: SeDebugPrivilege 2948 Registry.exe Token: SeDebugPrivilege 4908 Registry.exe Token: SeDebugPrivilege 4220 Registry.exe Token: SeDebugPrivilege 4836 Registry.exe Token: SeDebugPrivilege 3236 Registry.exe Token: SeDebugPrivilege 4000 Registry.exe Token: SeDebugPrivilege 5004 Registry.exe Token: SeDebugPrivilege 3428 Registry.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3216 wrote to memory of 2908 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 140 PID 3216 wrote to memory of 2908 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 140 PID 3216 wrote to memory of 2908 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 140 PID 2908 wrote to memory of 3692 2908 tmpB603.tmp.exe 142 PID 2908 wrote to memory of 3692 2908 tmpB603.tmp.exe 142 PID 2908 wrote to memory of 3692 2908 tmpB603.tmp.exe 142 PID 2908 wrote to memory of 3692 2908 tmpB603.tmp.exe 142 PID 2908 wrote to memory of 3692 2908 tmpB603.tmp.exe 142 PID 2908 wrote to memory of 3692 2908 tmpB603.tmp.exe 142 PID 2908 wrote to memory of 3692 2908 tmpB603.tmp.exe 142 PID 3216 wrote to memory of 2400 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 153 PID 3216 wrote to memory of 2400 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 153 PID 3216 wrote to memory of 4496 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 154 PID 3216 wrote to memory of 4496 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 154 PID 3216 wrote to memory of 3012 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 155 PID 3216 wrote to memory of 3012 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 155 PID 3216 wrote to memory of 3452 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 156 PID 3216 wrote to memory of 3452 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 156 PID 3216 wrote to memory of 5040 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 157 PID 3216 wrote to memory of 5040 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 157 PID 3216 wrote to memory of 3292 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 158 PID 3216 wrote to memory of 3292 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 158 PID 3216 wrote to memory of 396 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 160 PID 3216 wrote to memory of 396 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 160 PID 3216 wrote to memory of 3276 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 161 PID 3216 wrote to memory of 3276 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 161 PID 3216 wrote to memory of 3560 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 162 PID 3216 wrote to memory of 3560 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 162 PID 3216 wrote to memory of 4036 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 163 PID 3216 wrote to memory of 4036 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 163 PID 3216 wrote to memory of 4972 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 164 PID 3216 wrote to memory of 4972 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 164 PID 3216 wrote to memory of 3720 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 174 PID 3216 wrote to memory of 3720 3216 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe 174 PID 3720 wrote to memory of 4912 3720 cmd.exe 177 PID 3720 wrote to memory of 4912 3720 cmd.exe 177 PID 3720 wrote to memory of 1712 3720 cmd.exe 179 PID 3720 wrote to memory of 1712 3720 cmd.exe 179 PID 1712 wrote to memory of 1800 1712 Registry.exe 181 PID 1712 wrote to memory of 1800 1712 Registry.exe 181 PID 1712 wrote to memory of 4240 1712 Registry.exe 182 PID 1712 wrote to memory of 4240 1712 Registry.exe 182 PID 1712 wrote to memory of 820 1712 Registry.exe 183 PID 1712 wrote to memory of 820 1712 Registry.exe 183 PID 1712 wrote to memory of 820 1712 Registry.exe 183 PID 820 wrote to memory of 684 820 tmp4AE.tmp.exe 185 PID 820 wrote to memory of 684 820 tmp4AE.tmp.exe 185 PID 820 wrote to memory of 684 820 tmp4AE.tmp.exe 185 PID 820 wrote to memory of 684 820 tmp4AE.tmp.exe 185 PID 820 wrote to memory of 684 820 tmp4AE.tmp.exe 185 PID 820 wrote to memory of 684 820 tmp4AE.tmp.exe 185 PID 820 wrote to memory of 684 820 tmp4AE.tmp.exe 185 PID 1800 wrote to memory of 1692 1800 WScript.exe 188 PID 1800 wrote to memory of 1692 1800 WScript.exe 188 PID 1692 wrote to memory of 1592 1692 Registry.exe 192 PID 1692 wrote to memory of 1592 1692 Registry.exe 192 PID 1692 wrote to memory of 3552 1692 Registry.exe 193 PID 1692 wrote to memory of 3552 1692 Registry.exe 193 PID 1692 wrote to memory of 4224 1692 Registry.exe 195 PID 1692 wrote to memory of 4224 1692 Registry.exe 195 PID 1692 wrote to memory of 4224 1692 Registry.exe 195 PID 4224 wrote to memory of 2128 4224 tmp2342.tmp.exe 197 PID 4224 wrote to memory of 2128 4224 tmp2342.tmp.exe 197 PID 4224 wrote to memory of 2128 4224 tmp2342.tmp.exe 197 -
System policy modification 1 TTPs 42 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe"C:\Users\Admin\AppData\Local\Temp\4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\tmpB603.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB603.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\tmpB603.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB603.tmp.exe"3⤵
- Executes dropped EXE
PID:3692
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3276
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JXArPKtZVz.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:4912
-
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1712 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8871802c-fbd3-4866-bb96-e8b1f0eab784.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1692 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a74c8e64-e0a5-4767-8876-06c54256768b.vbs"6⤵PID:1592
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3412 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3744082-178f-4fb8-8305-22168e592630.vbs"8⤵PID:460
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5036 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\936c0347-2527-44eb-9d63-5c54e41e7c93.vbs"10⤵PID:1648
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3748 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2523950-b7fd-45b5-a3d3-d892462873ff.vbs"12⤵PID:1808
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2948 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78279cce-0834-4ce7-884f-51025e906453.vbs"14⤵PID:2160
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4908 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f07b0632-e0a0-4834-9cc5-fb3ee37eef0f.vbs"16⤵PID:404
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4220 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57a8059c-0609-4bf9-8e06-ecd002fac0a0.vbs"18⤵PID:3604
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4836 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac0d7cc6-d480-4647-8c53-892151473a8e.vbs"20⤵PID:460
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3236 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3ccf5517-81b1-45e4-877e-0f87c4f67da6.vbs"22⤵PID:1132
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4000 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8445539-b919-4c4a-a633-eb3f19759892.vbs"24⤵PID:456
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5004 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25db516b-c1d6-4ef1-992a-e30ca6f3def4.vbs"26⤵PID:3648
-
C:\Program Files\Mozilla Firefox\fonts\Registry.exe"C:\Program Files\Mozilla Firefox\fonts\Registry.exe"27⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3428 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c16ad20b-fb7f-48ba-8ccc-75b2241ec03e.vbs"28⤵PID:2400
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95274962-9825-49cc-bb2f-8943f1a83ccb.vbs"28⤵PID:3176
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD2C7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD2C7.tmp.exe"28⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:452 -
C:\Users\Admin\AppData\Local\Temp\tmpD2C7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD2C7.tmp.exe"29⤵
- Executes dropped EXE
PID:2500
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b4d9ade-0a14-4bd3-91ff-60e9432ac03f.vbs"26⤵PID:4788
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07de029b-7705-47cc-9000-f15ad18e9a66.vbs"24⤵PID:4224
-
-
C:\Users\Admin\AppData\Local\Temp\tmp9A04.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9A04.tmp.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\tmp9A04.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9A04.tmp.exe"25⤵
- Executes dropped EXE
PID:2388
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82144091-2f8b-4bde-84b2-38e96b9e9961.vbs"22⤵PID:4768
-
-
C:\Users\Admin\AppData\Local\Temp\tmp67F7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp67F7.tmp.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\tmp67F7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp67F7.tmp.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\tmp67F7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp67F7.tmp.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\tmp67F7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp67F7.tmp.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:636 -
C:\Users\Admin\AppData\Local\Temp\tmp67F7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp67F7.tmp.exe"26⤵
- Executes dropped EXE
PID:3360
-
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e1a7b70-2c2d-4255-a4e6-67c6ef6f18cf.vbs"20⤵PID:1204
-
-
C:\Users\Admin\AppData\Local\Temp\tmp354F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp354F.tmp.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\tmp354F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp354F.tmp.exe"21⤵
- Executes dropped EXE
PID:4492
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94d97f6f-5eed-4094-a38a-b80224b700f3.vbs"18⤵PID:640
-
-
C:\Users\Admin\AppData\Local\Temp\tmp313.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp313.tmp.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\tmp313.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp313.tmp.exe"19⤵
- Executes dropped EXE
PID:4200
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54bd38af-87c5-48fe-9d3b-dda23650be95.vbs"16⤵PID:4848
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD116.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD116.tmp.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\tmpD116.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD116.tmp.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\tmpD116.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD116.tmp.exe"18⤵
- Executes dropped EXE
PID:3920
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a836feb-e577-49af-8e4b-1495fed3ad27.vbs"14⤵PID:1596
-
-
C:\Users\Admin\AppData\Local\Temp\tmpB10B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB10B.tmp.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:740 -
C:\Users\Admin\AppData\Local\Temp\tmpB10B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB10B.tmp.exe"15⤵
- Executes dropped EXE
PID:4336
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e65594d1-2841-4153-942b-9b5d307fbc07.vbs"12⤵PID:3872
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7D49.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7D49.tmp.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\tmp7D49.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7D49.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\tmp7D49.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7D49.tmp.exe"14⤵
- Executes dropped EXE
PID:4704
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\950f041f-2a11-49b4-a769-b8787cb9028e.vbs"10⤵PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\tmp5EC5.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5EC5.tmp.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\tmp5EC5.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5EC5.tmp.exe"11⤵
- Executes dropped EXE
PID:4228
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\468810d4-d71b-4ae5-b835-19897f8d6c88.vbs"8⤵PID:5112
-
-
C:\Users\Admin\AppData\Local\Temp\tmp410B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp410B.tmp.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\tmp410B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp410B.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\tmp410B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp410B.tmp.exe"10⤵
- Executes dropped EXE
PID:2056
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\157a85d1-e1c5-4d60-acd0-6376f75ccfe6.vbs"6⤵PID:3552
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2342.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2342.tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\tmp2342.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2342.tmp.exe"7⤵
- Executes dropped EXE
PID:2128
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac7ffc9f-ba9e-46d6-ba56-7f58f6154415.vbs"4⤵PID:4240
-
-
C:\Users\Admin\AppData\Local\Temp\tmp4AE.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4AE.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\tmp4AE.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4AE.tmp.exe"5⤵
- Executes dropped EXE
PID:684
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b144" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14" /sc ONLOGON /tr "'C:\Users\Default User\4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b144" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\setup\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\es-ES\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\es-ES\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellExperiences\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Windows\ShellExperiences\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b144" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b144" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b144" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b144" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\4df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\PrintHood\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\PrintHood\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\fonts\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\fonts\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\TAPI\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\TAPI\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Users\Default\PrintHood\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Users\Default\PrintHood\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\defaults\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\defaults\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5ef4e169ef6834d5a414c398f022bb198
SHA1911b386194313c6d8ac424b3b6ca3059550a20fd
SHA2563a6981f3dbdc904b463fd575c8088ac8aabf9b3b93c7e0c2219fb662ba33097b
SHA5125402b064fbaaecfec3cd387caace1bf0a22805087559087f4bb7ff33b45141d4e32448bababb1542cfbcf0691e5cb750cf659258e995e400a06fd67f677ea93a
-
Filesize
4.9MB
MD534ba4fc948fa96e770d3b9c113a9b1ba
SHA115896a3edfedfda790940cfff8f789507b4f01c5
SHA2566c0e60d3796f73dab9d0c35f0bef7c69cf0a34133f35555d9811e92d407eab61
SHA512c0533332c6d792d827d81b1607bd42c4860cb28c11e5d05606cd0c7b683b051f58a66d6ccb015d85dbae223cdffed5491ae7ecc2d54c7a98bdbc0b23dab48588
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
64B
MD532eb22918ace6c7c852e6547fee66953
SHA18608868448f9c6f0a42d06a8f833b5598236f159
SHA256a1d8638e84347a9b06b2f3ad194e72eef4783d24d26feccb7a8e46b1d907eace
SHA5129bb067f85829cdde4287e55dd1d1ba1645d59811560594a430e47166d907e30c4680bd7af1e380ca41240c4d4370ed371494f2151b6a8523ebe5bc7dabba6bb3
-
Filesize
727B
MD5a9d872b14aa58e7bc7ab52f15b0d7aed
SHA10d897f30f5a74a9f594db56d1e1829223eac1b82
SHA256242129e9d01d2a3520cb60cce88d57e92fc175dd567b50c8616d43a191d3b25f
SHA51286cec81e0783d2fa003e92b3fb7382d7849d129a3bced5140f8e96f31284f031a4eb3da22bc2121dd091806394e03626bf31144bde3fa2c129ef178c984a8ebb
-
Filesize
727B
MD5160e8cfd01eb375fedf778bf7fe36ad9
SHA1f52eb95b56126347645689b5d0a5db0dbdcce3be
SHA256b290b72a58ae66a4d2d1c7118eb80ff2935412930a7904b069b62b04878e8a15
SHA5126fa51840070154ef9ad5862f967c877c12a2f96945277ef7bc1895ac74e7473285d9469d2a66aca4ea767332ab7d8b3457eed21dc21bd60f9f3c15a35829db3b
-
Filesize
727B
MD5e8b559e44fd88e51d45235127ed95369
SHA1d3757953ad940f4cd8117de1a4144f435c88ba7c
SHA2565cc56c54fa8177a1d02f4022fde17aa8c054589fe4c72fe340a2564b99ee3155
SHA51260ce853dbf9549409e51d3b4d83bacaf019e96b64b99329b3d2df9bbac3740507e608b7297e41fdd173aed25450d86e98966457d3a59ddee744326a6048569e0
-
Filesize
216B
MD5618768ea4dfba758667e58f487cc962c
SHA1b8861c587cc860056d574f9a4a9fb69c278be206
SHA2564be795aec855328f747ef44bd4d7ab77f65e02911e1220aaf3631c9acf9d1286
SHA51231e893aa1097d2f9e142cc4262f72ad808f2fa4afd0c0506a6a2ea8e39f21a1a67b48203f75a4b11d90f12c9e9ec9a3210a56c6a1547a82c28b518a356ce628c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
727B
MD5ff17d74c85c02be7fac1bda91466afb2
SHA11c564beb9744181cd1604576158f7e617ba56fdc
SHA25638d534f008aee802c7cf0e3b2b93bd01ce72b77ea0ecc6991db84277809af416
SHA512131d36520de7bc96efe2fcdd523c64f5e783b240df3c5605d9b6f4db20fb191cdf36f50338a32b0ba36756b32d7e203356cb203f577f4b3e5a5e2ec64239d13f
-
Filesize
727B
MD5fe4ead7e6f04b16baf861dc7642ad473
SHA1377bd237b10ea45c8272ee586efaf8d86b40b9ce
SHA2565c3304908d80579cde9ebd25304a50d5aed2b333e3651e19672a63018ab6bf0e
SHA512cc4bdde415c3b1499a29741b042e0a8638c39bd3489c67f1a3fb14220efef28711d426a850bd4f7c5d5ef70c867f68bf6716c4291848147cd1f5060f204be4df
-
Filesize
503B
MD5c465cb464ca9b5b4748df804cd4b0f56
SHA1f81a8b9d7a4d3f4c67f2ea3894157549c3277887
SHA2562070e1e8634721a03f31632c87202e918c56e7b50c6a2489ae8182a35f4aea43
SHA51299b2ec07e3a08ead1d451047a93108f8e08e459d74cd71eeda561635fcb2cfc38a7d0039c12f5be61fb0d83fb429aa3640405569c00e47b98c00e86bcb5241c1
-
Filesize
727B
MD53aa6b96a617f70e937f9cb8d6724ce3b
SHA1f38c53060e2bd1f348e346d9bc90318d938e6cd4
SHA256dcd7af61474c14cae263cf19cdc1bb5e15330a8cf7f6139717d4406e360dc21d
SHA5126df241699094d695462544443f2e7e236bf1490a7d3d947797a1ef53274a939e9fdc93f74dcc8dcad68d0444cc55692aef6a001b78301490e74d509fdaea2159
-
Filesize
727B
MD554314c7c2ef931597b90c8769808607c
SHA159277f640a25786db49855ebde8536334d7f7f67
SHA256b17b1024a3a173a6bbc752890a4f8a86130800a52d6608486db380c548f38026
SHA512519da3c9f17a8dfebcf9b52b78c12bf76ee9163fe11d12e21ff93e445e160eb831341a626c79ad38f5e03400a42c946e0594c4e860645ef6c1e8e3a8abd96bcf
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
4.9MB
MD56e7923159a06c48bb09a81080d2d8266
SHA1a2126afd2d75f3dedb602fd7f63b9940e0b47c22
SHA2564df2dbcbeb6a3e0e6909c6bf1543308f4de207ee57a904fda2ed2ed0e6522b14
SHA512d2ddd13c739e92febab2685f393aeed15140c4b03d3c15ec49c86bac764ab6e3a01982a64118bd9d4e700161b85e1a7f3a91f904322ecc17d6253174a08f4365