colibri | cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
Size

4.9MB
MD5

f605296b4b314f194d7c23f29eb9cd90
SHA1

0c8838372279256fa34fab408e4d0727464f7cfb
SHA256

cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96
SHA512

c63eeb73bc4d4b19d63a4376c8bca1b58aea98578cb619b3f96270ea0dda70f620dce45269a0b4b2a455c362dbf0047e18662d9c65f9f2ac0c8a1a8e57977f1e
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1120	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	648	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	4996	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	4996	schtasks.exe	83

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4124-2-0x000000001C0A0000-0x000000001C1CE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1060	powershell.exe
1664	powershell.exe
1120	powershell.exe
3676	powershell.exe
4436	powershell.exe
4676	powershell.exe
4756	powershell.exe
4936	powershell.exe
840	powershell.exe
2716	powershell.exe
1352	powershell.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	sihost.exe

Executes dropped EXE 37 IoCs

pid	Process
1848	tmpA79C.tmp.exe
924	tmpA79C.tmp.exe
636	sihost.exe
1916	tmpEB79.tmp.exe
3660	tmpEB79.tmp.exe
3760	tmpEB79.tmp.exe
1880	sihost.exe
2668	tmp1B43.tmp.exe
4236	tmp1B43.tmp.exe
2852	tmp1B43.tmp.exe
444	tmp1B43.tmp.exe
232	sihost.exe
2208	tmp4A91.tmp.exe
3640	tmp4A91.tmp.exe
4536	tmp4A91.tmp.exe
3124	sihost.exe
3668	tmp66A4.tmp.exe
1796	tmp66A4.tmp.exe
4492	sihost.exe
4660	tmp98A1.tmp.exe
4456	tmp98A1.tmp.exe
1648	sihost.exe
4504	tmpB551.tmp.exe
1644	tmpB551.tmp.exe
2616	tmpB551.tmp.exe
2528	sihost.exe
3316	tmpE79C.tmp.exe
3472	tmpE79C.tmp.exe
1588	tmpE79C.tmp.exe
4564	tmpE79C.tmp.exe
4812	sihost.exe
3660	tmp304.tmp.exe
4560	tmp304.tmp.exe
2508	sihost.exe
1492	sihost.exe
5052	tmp4F5E.tmp.exe
2012	tmp4F5E.tmp.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 924	1848	tmpA79C.tmp.exe	134
PID 3660 set thread context of 3760	3660	tmpEB79.tmp.exe	175
PID 2852 set thread context of 444	2852	tmp1B43.tmp.exe	190
PID 3640 set thread context of 4536	3640	tmp4A91.tmp.exe	200
PID 3668 set thread context of 1796	3668	tmp66A4.tmp.exe	209
PID 4660 set thread context of 4456	4660	tmp98A1.tmp.exe	219
PID 1644 set thread context of 2616	1644	tmpB551.tmp.exe	229
PID 1588 set thread context of 4564	1588	tmpE79C.tmp.exe	240
PID 3660 set thread context of 4560	3660	tmp304.tmp.exe	249
PID 5052 set thread context of 2012	5052	tmp4F5E.tmp.exe	265

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\6ccacd8608530f	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\lsass.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\SppExtComObj.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXAE95.tmp	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\dwm.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\RCXB2BE.tmp	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCXC0DD.tmp	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\uk-UA\Registry.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Program Files\Windows Multimedia Platform\SppExtComObj.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Program Files (x86)\Windows Mail\dwm.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Program Files (x86)\Windows Mail\6cb0b6c459d5d3	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backgroundTaskHost.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\Registry.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backgroundTaskHost.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\eddb19405b7ce1	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Program Files\Windows Media Player\Idle.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\6203df4a6bafc7	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files\Windows Media Player\Idle.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\lsass.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\ee2ad38f3d4382	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\uk-UA\RCXA597.tmp	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXAC62.tmp	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXB9D5.tmp	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Program Files\Windows Multimedia Platform\e1ef82546f0b02	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\uk-UA\fontdrvhost.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Windows\Branding\886983d96e3d3e	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Windows\Branding\csrss.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Windows\Offline Web Pages\sihost.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Windows\WaaS\wininit.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Windows\Branding\csrss.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Windows\Offline Web Pages\sihost.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Windows\Offline Web Pages\66fc9ff0ee96c2	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Windows\uk-UA\RCXA7AD.tmp	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Windows\uk-UA\fontdrvhost.exe	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Windows\Branding\RCXA9C1.tmp	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File opened for modification	C:\Windows\Offline Web Pages\RCXC506.tmp	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
File created	C:\Windows\uk-UA\5b884080fd4f94	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp304.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1B43.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1B43.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4A91.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB551.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4F5E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpEB79.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpEB79.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp66A4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp98A1.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE79C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1B43.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4A91.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB551.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE79C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA79C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE79C.tmp.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	sihost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4584	schtasks.exe
544	schtasks.exe
3760	schtasks.exe
60	schtasks.exe
3020	schtasks.exe
1120	schtasks.exe
636	schtasks.exe
4936	schtasks.exe
1352	schtasks.exe
4036	schtasks.exe
5004	schtasks.exe
3352	schtasks.exe
532	schtasks.exe
4636	schtasks.exe
2004	schtasks.exe
3464	schtasks.exe
5012	schtasks.exe
2716	schtasks.exe
3552	schtasks.exe
3652	schtasks.exe
2484	schtasks.exe
4904	schtasks.exe
4080	schtasks.exe
2848	schtasks.exe
1664	schtasks.exe
1908	schtasks.exe
2132	schtasks.exe
3672	schtasks.exe
1168	schtasks.exe
1704	schtasks.exe
4704	schtasks.exe
3828	schtasks.exe
4072	schtasks.exe
2156	schtasks.exe
3560	schtasks.exe
4004	schtasks.exe
5040	schtasks.exe
4728	schtasks.exe
3416	schtasks.exe
3328	schtasks.exe
1904	schtasks.exe
4552	schtasks.exe
648	schtasks.exe
1580	schtasks.exe
5008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
3676	powershell.exe
3676	powershell.exe
1664	powershell.exe
1664	powershell.exe
4676	powershell.exe
4676	powershell.exe
2716	powershell.exe
2716	powershell.exe
1352	powershell.exe
1352	powershell.exe
4936	powershell.exe
4936	powershell.exe
4756	powershell.exe
4756	powershell.exe
1120	powershell.exe
1120	powershell.exe
840	powershell.exe
840	powershell.exe
4436	powershell.exe
4436	powershell.exe
1060	powershell.exe
1060	powershell.exe
4756	powershell.exe
1120	powershell.exe
840	powershell.exe
4436	powershell.exe
1664	powershell.exe
4676	powershell.exe
3676	powershell.exe
1352	powershell.exe
2716	powershell.exe
4936	powershell.exe
1060	powershell.exe
636	sihost.exe
1880	sihost.exe
232	sihost.exe
3124	sihost.exe
4492	sihost.exe
1648	sihost.exe
2528	sihost.exe
4812	sihost.exe
2508	sihost.exe
1492	sihost.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	636	sihost.exe
Token: SeDebugPrivilege	1880	sihost.exe
Token: SeDebugPrivilege	232	sihost.exe
Token: SeDebugPrivilege	3124	sihost.exe
Token: SeDebugPrivilege	4492	sihost.exe
Token: SeDebugPrivilege	1648	sihost.exe
Token: SeDebugPrivilege	2528	sihost.exe
Token: SeDebugPrivilege	4812	sihost.exe
Token: SeDebugPrivilege	2508	sihost.exe
Token: SeDebugPrivilege	1492	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 1848	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	131
PID 4124 wrote to memory of 1848	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	131
PID 4124 wrote to memory of 1848	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	131
PID 1848 wrote to memory of 924	1848	tmpA79C.tmp.exe	134
PID 1848 wrote to memory of 924	1848	tmpA79C.tmp.exe	134
PID 1848 wrote to memory of 924	1848	tmpA79C.tmp.exe	134
PID 1848 wrote to memory of 924	1848	tmpA79C.tmp.exe	134
PID 1848 wrote to memory of 924	1848	tmpA79C.tmp.exe	134
PID 1848 wrote to memory of 924	1848	tmpA79C.tmp.exe	134
PID 1848 wrote to memory of 924	1848	tmpA79C.tmp.exe	134
PID 4124 wrote to memory of 1060	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	142
PID 4124 wrote to memory of 1060	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	142
PID 4124 wrote to memory of 1664	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	143
PID 4124 wrote to memory of 1664	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	143
PID 4124 wrote to memory of 4676	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	144
PID 4124 wrote to memory of 4676	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	144
PID 4124 wrote to memory of 4436	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	145
PID 4124 wrote to memory of 4436	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	145
PID 4124 wrote to memory of 2716	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	146
PID 4124 wrote to memory of 2716	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	146
PID 4124 wrote to memory of 840	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	147
PID 4124 wrote to memory of 840	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	147
PID 4124 wrote to memory of 4936	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	148
PID 4124 wrote to memory of 4936	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	148
PID 4124 wrote to memory of 3676	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	149
PID 4124 wrote to memory of 3676	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	149
PID 4124 wrote to memory of 1120	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	150
PID 4124 wrote to memory of 1120	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	150
PID 4124 wrote to memory of 4756	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	152
PID 4124 wrote to memory of 4756	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	152
PID 4124 wrote to memory of 1352	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	154
PID 4124 wrote to memory of 1352	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	154
PID 4124 wrote to memory of 2392	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	164
PID 4124 wrote to memory of 2392	4124	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe	164
PID 2392 wrote to memory of 1696	2392	cmd.exe	166
PID 2392 wrote to memory of 1696	2392	cmd.exe	166
PID 2392 wrote to memory of 636	2392	cmd.exe	168
PID 2392 wrote to memory of 636	2392	cmd.exe	168
PID 636 wrote to memory of 3324	636	sihost.exe	170
PID 636 wrote to memory of 3324	636	sihost.exe	170
PID 636 wrote to memory of 3612	636	sihost.exe	171
PID 636 wrote to memory of 3612	636	sihost.exe	171
PID 636 wrote to memory of 1916	636	sihost.exe	172
PID 636 wrote to memory of 1916	636	sihost.exe	172
PID 636 wrote to memory of 1916	636	sihost.exe	172
PID 1916 wrote to memory of 3660	1916	tmpEB79.tmp.exe	174
PID 1916 wrote to memory of 3660	1916	tmpEB79.tmp.exe	174
PID 1916 wrote to memory of 3660	1916	tmpEB79.tmp.exe	174
PID 3660 wrote to memory of 3760	3660	tmpEB79.tmp.exe	175
PID 3660 wrote to memory of 3760	3660	tmpEB79.tmp.exe	175
PID 3660 wrote to memory of 3760	3660	tmpEB79.tmp.exe	175
PID 3660 wrote to memory of 3760	3660	tmpEB79.tmp.exe	175
PID 3660 wrote to memory of 3760	3660	tmpEB79.tmp.exe	175
PID 3660 wrote to memory of 3760	3660	tmpEB79.tmp.exe	175
PID 3660 wrote to memory of 3760	3660	tmpEB79.tmp.exe	175
PID 3324 wrote to memory of 1880	3324	WScript.exe	178
PID 3324 wrote to memory of 1880	3324	WScript.exe	178
PID 1880 wrote to memory of 460	1880	sihost.exe	182
PID 1880 wrote to memory of 460	1880	sihost.exe	182
PID 1880 wrote to memory of 4356	1880	sihost.exe	183
PID 1880 wrote to memory of 4356	1880	sihost.exe	183
PID 1880 wrote to memory of 2668	1880	sihost.exe	186
PID 1880 wrote to memory of 2668	1880	sihost.exe	186
PID 1880 wrote to memory of 2668	1880	sihost.exe	186

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe
"C:\Users\Admin\AppData\Local\Temp\cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96N.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4124
- C:\Users\Admin\AppData\Local\Temp\tmpA79C.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpA79C.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Users\Admin\AppData\Local\Temp\tmpA79C.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpA79C.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Tb43hevojt.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1696
- - C:\Windows\Offline Web Pages\sihost.exe
    "C:\Windows\Offline Web Pages\sihost.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:636
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e5aff27-f7ba-43ed-89e8-a9ab1adcbe12.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3324
    - - C:\Windows\Offline Web Pages\sihost.exe
        
        "C:\Windows\Offline Web Pages\sihost.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1880
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f24c969-cb7d-44bc-a323-7d332a8015d5.vbs"
        6⤵
        
        PID:460
        
        C:\Windows\Offline Web Pages\sihost.exe
        
        "C:\Windows\Offline Web Pages\sihost.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f94773d8-6299-4717-bd47-0109537e9fc6.vbs"
        8⤵
        
        PID:4576
        
        C:\Windows\Offline Web Pages\sihost.exe
        
        "C:\Windows\Offline Web Pages\sihost.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b700411d-2976-429e-a7cf-94e7e09f6954.vbs"
        10⤵
        
        PID:748
        
        C:\Windows\Offline Web Pages\sihost.exe
        
        "C:\Windows\Offline Web Pages\sihost.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4492
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\13993ec8-e848-4303-b741-6d86c99a6a9b.vbs"
        12⤵
        
        PID:2220
        
        C:\Windows\Offline Web Pages\sihost.exe
        
        "C:\Windows\Offline Web Pages\sihost.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66ddf9e8-e882-4ee8-9859-ff82eaa6d838.vbs"
        14⤵
        
        PID:3140
        
        C:\Windows\Offline Web Pages\sihost.exe
        
        "C:\Windows\Offline Web Pages\sihost.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\010a1895-ced6-488e-81fa-29e1c6e18a9d.vbs"
        16⤵
        
        PID:1848
        
        C:\Windows\Offline Web Pages\sihost.exe
        
        "C:\Windows\Offline Web Pages\sihost.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b39f44c5-40bf-4b7b-bb99-edde49c48377.vbs"
        18⤵
        
        PID:3248
        
        C:\Windows\Offline Web Pages\sihost.exe
        
        "C:\Windows\Offline Web Pages\sihost.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\688ca738-27ac-42d2-bf9f-5bca7bc6877e.vbs"
        20⤵
        
        PID:2300
        
        C:\Windows\Offline Web Pages\sihost.exe
        
        "C:\Windows\Offline Web Pages\sihost.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1492
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f8e1763-d800-4233-bdbb-45cf49ac7c53.vbs"
        22⤵
        
        PID:4428
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35e59383-d5f9-40bc-bfc6-c8b78aa0bb12.vbs"
        22⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\tmp4F5E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4F5E.tmp.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\tmp4F5E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4F5E.tmp.exe"
        23⤵
        Executes dropped EXE
        
        PID:2012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a033ebd9-6080-4992-a18f-4003d6909b6a.vbs"
        20⤵
        
        PID:2716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\74aba92e-a25f-4078-90bf-27f3a5227b52.vbs"
        18⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\tmp304.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp304.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\tmp304.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp304.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b531f33-e3bb-498f-bdc4-63680d26b66f.vbs"
        16⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\tmpE79C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE79C.tmp.exe"
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\tmpE79C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE79C.tmp.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\tmpE79C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE79C.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\tmpE79C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE79C.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:4564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b731dc20-a16e-4b1c-ae5e-b641882d5811.vbs"
        14⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\tmpB551.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB551.tmp.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\tmpB551.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB551.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\tmpB551.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB551.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:2616
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b9db7de6-7b07-4ef6-abe1-3ccaf675cbf7.vbs"
        12⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\tmp98A1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp98A1.tmp.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\tmp98A1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp98A1.tmp.exe"
        13⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5104d34d-7d5d-4c2d-a21c-f8a6b2af9477.vbs"
        10⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\tmp66A4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp66A4.tmp.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\tmp66A4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp66A4.tmp.exe"
        11⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c6cca69-6b4d-4096-b40c-0fc26bffe1ab.vbs"
        8⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\tmp4A91.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4A91.tmp.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\tmp4A91.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4A91.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\tmp4A91.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4A91.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:4536
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab172ad1-9453-4fef-9a2c-b161f56c56e2.vbs"
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\tmp1B43.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1B43.tmp.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\tmp1B43.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1B43.tmp.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\tmp1B43.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1B43.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\tmp1B43.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1B43.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:444
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f83d7d06-e7cc-4148-a402-64e38ee31493.vbs"
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\tmpEB79.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpEB79.tmp.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\tmpEB79.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEB79.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\tmpEB79.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEB79.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\uk-UA\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Windows\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\Branding\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Branding\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Branding\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Links\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Links\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Links\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Windows\Offline Web Pages\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Windows\Offline Web Pages\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Mail\dwm.exe

Filesize
4.9MB

MD5
f605296b4b314f194d7c23f29eb9cd90

SHA1
0c8838372279256fa34fab408e4d0727464f7cfb

SHA256
cccfc00eebc8a50a2318d44d77dadc34cdf7db8b548783351b1e014d30d5ad96

SHA512
c63eeb73bc4d4b19d63a4376c8bca1b58aea98578cb619b3f96270ea0dda70f620dce45269a0b4b2a455c362dbf0047e18662d9c65f9f2ac0c8a1a8e57977f1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\13993ec8-e848-4303-b741-6d86c99a6a9b.vbs

Filesize
715B

MD5
48c87b19f6adaf055f7818b6431dd2b1

SHA1
6d20462c4e76d07d3c9e9d5ddc5fc46e2d932e58

SHA256
8760a926845113fc5c9df8e6132bea79b3013a0fd788e7d2783f9e0af232589d

SHA512
608ac9a71a0ef4227158c9b682dd8fe586f2450c538635b850c8d254d9fa0d9b6fe19bb02370e845405a0bed6deeecd830544ec409093a6699ad62d638cffdf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1f24c969-cb7d-44bc-a323-7d332a8015d5.vbs

Filesize
715B

MD5
d4540671de1d7759e3fbc4849e16e7e6

SHA1
f0e7cae0bbcf2974f2ca87b9256db950ecd2cb0f

SHA256
043ed31f8ca2c23f4709695efc469ab63041369fd2d856553957cbf0073d9b83

SHA512
ed9981beb631bc06feda94c96ad20c4f82c8748702a74c22b54af693a9cf61f41c09c44bb8e4cd514df8043eea977662f068cfa2d0be4a71a1ace25128fa2e49

Download Submit
C:\Users\Admin\AppData\Local\Temp\66ddf9e8-e882-4ee8-9859-ff82eaa6d838.vbs

Filesize
715B

MD5
e4796b8d3d78fa1d2cc686515e2c300c

SHA1
b49a9896be39d988190c7e1ff92b01c0af5ce211

SHA256
b9a4eb7c173d4421a4deafdc48e5a60e9d9034b6d2c9de33cae6d28882ae03a4

SHA512
1f1f0168b202db1cc3086458b5a96fcf2055f55399d125c94003d9ea81ce9d89d245e3b7ea861a98ecc8db1eaf34c75cf3732c01cdf2d732d915d8434c896b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\9e5aff27-f7ba-43ed-89e8-a9ab1adcbe12.vbs

Filesize
714B

MD5
bd918dda6db47ea599d37a6786a3710a

SHA1
70d1621e0040dcdc25c99d370de46b3bb89dd319

SHA256
a7da1f61751cfba9b8d2e4828f450289336f0adf80f930f9be3411438f565625

SHA512
e2bba99740d7f5ee0f53712a31ed7448a4790c44fe7f4ce30672f041064ed30c4b4766e67aa9dca94aaad482807ccb5a573be51bb2c183edc4ac9dda0e5eb713

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tb43hevojt.bat

Filesize
204B

MD5
207db5ab9572b28c35c8ac3ddab09f0b

SHA1
ea0a2de1fc06de087fc5e890304eb925d57c3d6a

SHA256
b97869eb101685aa9bfc508f156cb189fe83b34d0455b3bc389feb3740f1e954

SHA512
5f4d96468a9b705f4fca77fa61222df0929360b0415e0365922a0445953ee53c92a2388b9baaac9d222319a10278ef755d21767057e8898484c2f58f007e02fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_obinehv2.rcv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b700411d-2976-429e-a7cf-94e7e09f6954.vbs

Filesize
715B

MD5
bfddef3a1a869f8e3830b61cf79b635a

SHA1
4964e7d28404b0569951fa9b2696f5d339d197fe

SHA256
79405bce90e082331a82b47a45fae1fa3d61901ea95e6283c33a866f6fcdc7b5

SHA512
ad705b5505cee0be5be3d71b18b7a76daa41c2a78efe2786426904485800c0967595975708bde59c553048bae97a60ad351233cea457c678ae60f040eba9911f

Download Submit
C:\Users\Admin\AppData\Local\Temp\f83d7d06-e7cc-4148-a402-64e38ee31493.vbs

Filesize
491B

MD5
325893f057039c0d75af8ac882448031

SHA1
547bf7b373f2c1279c3e0029c4ecb9fd4186d4be

SHA256
dcfd9540b73e00109f25d9faf7c4950bcd7fa84dca2ebbad3712b1454798c2db

SHA512
7e39ce5ff2d902d0a4c76a49cf0c79ba6ad947c3304ddf19487a308f26c5f40c21b6c450ccbfb42f908902ac8a3ac0ef74b576680b807d30b6af9db95c9e2eab

Download Submit
C:\Users\Admin\AppData\Local\Temp\f94773d8-6299-4717-bd47-0109537e9fc6.vbs

Filesize
714B

MD5
f8e4938fc39d98da7456cf846702d0b8

SHA1
12ff899c0f04c9e4e9a0212c183dcab106aa1716

SHA256
4bd4602977ba07fa4e0c0fa8cf56e81074f0f9728624e79e1ebbe9f92839d6f6

SHA512
79782a53154b66effe8518998771c850cf73f3099cdbb76d417bdae7ee7e1e3ba6c75e3e7684f3d00c7ff496190d6c43370a9f824da53865235a69cd42c5a1a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA79C.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Default\StartMenuExperienceHost.exe

Filesize
4.9MB

MD5
805504474664295a7e42391cfdbb5eb6

SHA1
59037fecbde18eb2ab60c1b31d79af60526f4e23

SHA256
eb8fd6aaa27f9dcd92ec0119987d191770d8cb42fae8d07be6e12b394c80b0b4

SHA512
2710ccc20d77eb48b64027c03c9472d829c9132d579f4cfec859c05c11a1d6a1d07563fb75e611d309bb2e220725999d974fe87b9e5c29d3a67e11a187ba4f33

Download Submit
memory/232-356-0x00000000032F0000-0x0000000003302000-memory.dmp

Filesize
72KB

Download
memory/636-299-0x000000001B2B0000-0x000000001B2C2000-memory.dmp

Filesize
72KB

Download
memory/924-75-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2508-491-0x00000000037A0000-0x00000000037B2000-memory.dmp

Filesize
72KB

Download
memory/3676-199-0x000002B61D6F0000-0x000002B61D712000-memory.dmp

Filesize
136KB

Download
memory/4124-12-0x000000001CD00000-0x000000001D228000-memory.dmp

Filesize
5.2MB

Download
memory/4124-157-0x00007FFE43D40000-0x00007FFE44801000-memory.dmp

Filesize
10.8MB

Download
memory/4124-171-0x00007FFE43D40000-0x00007FFE44801000-memory.dmp

Filesize
10.8MB

Download
memory/4124-17-0x000000001C060000-0x000000001C068000-memory.dmp

Filesize
32KB

Download
memory/4124-15-0x000000001C040000-0x000000001C04E000-memory.dmp

Filesize
56KB

Download
memory/4124-13-0x00000000034E0000-0x00000000034EA000-memory.dmp

Filesize
40KB

Download
memory/4124-14-0x00000000034F0000-0x00000000034FE000-memory.dmp

Filesize
56KB

Download
memory/4124-18-0x000000001C070000-0x000000001C07C000-memory.dmp

Filesize
48KB

Download
memory/4124-11-0x00000000034D0000-0x00000000034E2000-memory.dmp

Filesize
72KB

Download
memory/4124-10-0x00000000034C0000-0x00000000034CA000-memory.dmp

Filesize
40KB

Download
memory/4124-8-0x0000000003490000-0x00000000034A6000-memory.dmp

Filesize
88KB

Download
memory/4124-16-0x000000001C050000-0x000000001C058000-memory.dmp

Filesize
32KB

Download
memory/4124-9-0x00000000034B0000-0x00000000034C0000-memory.dmp

Filesize
64KB

Download
memory/4124-6-0x0000000003470000-0x0000000003478000-memory.dmp

Filesize
32KB

Download
memory/4124-7-0x0000000003480000-0x0000000003490000-memory.dmp

Filesize
64KB

Download
memory/4124-5-0x000000001BFF0000-0x000000001C040000-memory.dmp

Filesize
320KB

Download
memory/4124-142-0x00007FFE43D43000-0x00007FFE43D45000-memory.dmp

Filesize
8KB

Download
memory/4124-4-0x0000000003450000-0x000000000346C000-memory.dmp

Filesize
112KB

Download
memory/4124-3-0x00007FFE43D40000-0x00007FFE44801000-memory.dmp

Filesize
10.8MB

Download
memory/4124-2-0x000000001C0A0000-0x000000001C1CE000-memory.dmp

Filesize
1.2MB

Download
memory/4124-1-0x0000000000D00000-0x00000000011F4000-memory.dmp

Filesize
5.0MB

Download
memory/4124-0-0x00007FFE43D43000-0x00007FFE43D45000-memory.dmp

Filesize
8KB

Download