colibri | 930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246

Analysis

max time kernel
119s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Size

4.9MB
MD5

5103a1bb4e59cbcc9d05cc7905681c9f
SHA1

2ef27ea1ad70d19c214586cf8f44a03853c6fdf1
SHA256

930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246
SHA512

fc6aef981ab43609850d0b2e79fa4d22646c439f12a267b177b00a67afc1879000f195f1677b24f60250bc8839c4825294b094a902fece31942e8b8ef0ecf33a
SSDEEP

49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8s:U

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3412	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2836	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	2836	schtasks.exe	82

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/3076-2-0x000000001B540000-0x000000001B66E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
4424	powershell.exe
4980	powershell.exe
1312	powershell.exe
2388	powershell.exe
3268	powershell.exe
2176	powershell.exe
2240	powershell.exe
3916	powershell.exe
4868	powershell.exe
116	powershell.exe
4024	powershell.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 37 IoCs

Processes:

tmpA6C2.tmp.exetmpA6C2.tmp.execsrss.exetmpDD50.tmp.exetmpDD50.tmp.execsrss.exetmpFABB.tmp.exetmpFABB.tmp.execsrss.exetmp3F08.tmp.exetmp3F08.tmp.execsrss.exetmp5BA8.tmp.exetmp5BA8.tmp.execsrss.exetmp7700.tmp.exetmp7700.tmp.execsrss.exetmp9323.tmp.exetmp9323.tmp.execsrss.exetmpC241.tmp.exetmpC241.tmp.exetmpC241.tmp.execsrss.exetmpF1ED.tmp.exetmpF1ED.tmp.execsrss.exetmp2215.tmp.exetmp2215.tmp.execsrss.exetmp3F13.tmp.exetmp3F13.tmp.execsrss.exetmp5B74.tmp.exetmp5B74.tmp.execsrss.exe

pid	Process
1004	tmpA6C2.tmp.exe
3436	tmpA6C2.tmp.exe
4620	csrss.exe
4280	tmpDD50.tmp.exe
696	tmpDD50.tmp.exe
544	csrss.exe
4704	tmpFABB.tmp.exe
1324	tmpFABB.tmp.exe
4716	csrss.exe
3288	tmp3F08.tmp.exe
4020	tmp3F08.tmp.exe
2572	csrss.exe
512	tmp5BA8.tmp.exe
2044	tmp5BA8.tmp.exe
4072	csrss.exe
4724	tmp7700.tmp.exe
5008	tmp7700.tmp.exe
3368	csrss.exe
5024	tmp9323.tmp.exe
2308	tmp9323.tmp.exe
1964	csrss.exe
4480	tmpC241.tmp.exe
3028	tmpC241.tmp.exe
116	tmpC241.tmp.exe
1468	csrss.exe
3064	tmpF1ED.tmp.exe
2540	tmpF1ED.tmp.exe
4980	csrss.exe
316	tmp2215.tmp.exe
3212	tmp2215.tmp.exe
2480	csrss.exe
868	tmp3F13.tmp.exe
3028	tmp3F13.tmp.exe
2044	csrss.exe
1076	tmp5B74.tmp.exe
2980	tmp5B74.tmp.exe
516	csrss.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.execsrss.execsrss.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

tmpA6C2.tmp.exetmpDD50.tmp.exetmpFABB.tmp.exetmp3F08.tmp.exetmp5BA8.tmp.exetmp7700.tmp.exetmp9323.tmp.exetmpC241.tmp.exetmpF1ED.tmp.exetmp2215.tmp.exetmp3F13.tmp.exetmp5B74.tmp.exe

description	pid	Process	procid_target
PID 1004 set thread context of 3436	1004	tmpA6C2.tmp.exe	136
PID 4280 set thread context of 696	4280	tmpDD50.tmp.exe	170
PID 4704 set thread context of 1324	4704	tmpFABB.tmp.exe	176
PID 3288 set thread context of 4020	3288	tmp3F08.tmp.exe	184
PID 512 set thread context of 2044	512	tmp5BA8.tmp.exe	190
PID 4724 set thread context of 5008	4724	tmp7700.tmp.exe	196
PID 5024 set thread context of 2308	5024	tmp9323.tmp.exe	202
PID 3028 set thread context of 116	3028	tmpC241.tmp.exe	209
PID 3064 set thread context of 2540	3064	tmpF1ED.tmp.exe	215
PID 316 set thread context of 3212	316	tmp2215.tmp.exe	221
PID 868 set thread context of 3028	868	tmp3F13.tmp.exe	227
PID 1076 set thread context of 2980	1076	tmp5B74.tmp.exe	233

Drops file in Program Files directory 16 IoCs

Processes:

930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe

description	ioc	Process
File created	C:\Program Files\Common Files\DESIGNER\886983d96e3d3e	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\dllhost.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\RCXBFE2.tmp	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\dllhost.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\taskhostw.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\csrss.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\5940a34987c991	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\taskhostw.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\ea9f0e6c9e2dcd	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCXC68C.tmp	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\RCXB4C2.tmp	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\csrss.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\csrss.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Program Files\Common Files\DESIGNER\csrss.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\886983d96e3d3e	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXB948.tmp	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe

Drops file in Windows directory 20 IoCs

Processes:

930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe

description	ioc	Process
File opened for modification	C:\Windows\Downloaded Program Files\csrss.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\RCXC264.tmp	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RCXC8A1.tmp	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Windows\Downloaded Program Files\csrss.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Windows\RemotePackages\RemoteApps\6203df4a6bafc7	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Windows\InputMethod\SHARED\27d1bcfc3c54e0	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCXA869.tmp	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Windows\PolicyDefinitions\es-ES\dllhost.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Windows\es-ES\RuntimeBroker.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\lsass.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Windows\es-ES\9e8d7a4ca61bd9	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Windows\PolicyDefinitions\es-ES\dllhost.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Windows\PolicyDefinitions\es-ES\5940a34987c991	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Windows\es-ES\RuntimeBroker.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Windows\PolicyDefinitions\es-ES\RCXAB29.tmp	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Windows\InputMethod\SHARED\System.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Windows\Downloaded Program Files\886983d96e3d3e	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Windows\InputMethod\SHARED\System.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File opened for modification	C:\Windows\es-ES\RCXBDDE.tmp	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
File created	C:\Windows\RemotePackages\RemoteApps\lsass.exe	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

tmp2215.tmp.exetmp3F13.tmp.exetmpDD50.tmp.exetmp3F08.tmp.exetmp5BA8.tmp.exetmp7700.tmp.exetmp9323.tmp.exetmpF1ED.tmp.exetmp5B74.tmp.exetmpA6C2.tmp.exetmpFABB.tmp.exetmpC241.tmp.exetmpC241.tmp.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2215.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3F13.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDD50.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3F08.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5BA8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7700.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9323.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF1ED.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5B74.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA6C2.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpFABB.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC241.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC241.tmp.exe

Modifies registry class 12 IoCs

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.exe930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
4060	schtasks.exe
4360	schtasks.exe
1408	schtasks.exe
1236	schtasks.exe
2772	schtasks.exe
3524	schtasks.exe
3360	schtasks.exe
4712	schtasks.exe
1460	schtasks.exe
1960	schtasks.exe
3060	schtasks.exe
4916	schtasks.exe
1492	schtasks.exe
2960	schtasks.exe
4964	schtasks.exe
3900	schtasks.exe
3528	schtasks.exe
4596	schtasks.exe
3412	schtasks.exe
2988	schtasks.exe
2148	schtasks.exe
4880	schtasks.exe
1872	schtasks.exe
2312	schtasks.exe
4372	schtasks.exe
952	schtasks.exe
2228	schtasks.exe
3928	schtasks.exe
4400	schtasks.exe
4408	schtasks.exe
3044	schtasks.exe
3300	schtasks.exe
3552	schtasks.exe
3596	schtasks.exe
1216	schtasks.exe
2720	schtasks.exe
4720	schtasks.exe
4816	schtasks.exe
2912	schtasks.exe
3108	schtasks.exe
4292	schtasks.exe
4128	schtasks.exe
1936	schtasks.exe
1388	schtasks.exe
4392	schtasks.exe
2544	schtasks.exe
4952	schtasks.exe
4864	schtasks.exe
2044	schtasks.exe
5012	schtasks.exe
1908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid	Process
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
3916	powershell.exe
3916	powershell.exe
116	powershell.exe
116	powershell.exe
2176	powershell.exe
2176	powershell.exe
2240	powershell.exe
2240	powershell.exe
3268	powershell.exe
3268	powershell.exe
2388	powershell.exe
2388	powershell.exe
4980	powershell.exe
4980	powershell.exe
4868	powershell.exe
4868	powershell.exe
4024	powershell.exe
4024	powershell.exe
1312	powershell.exe
1312	powershell.exe
4424	powershell.exe
4424	powershell.exe
3268	powershell.exe
3916	powershell.exe
4024	powershell.exe
116	powershell.exe
4868	powershell.exe
2240	powershell.exe
2176	powershell.exe
2388	powershell.exe
4980	powershell.exe
4424	powershell.exe
1312	powershell.exe
4620	csrss.exe
544	csrss.exe
4716	csrss.exe
2572	csrss.exe
4072	csrss.exe
3368	csrss.exe
1964	csrss.exe
1468	csrss.exe
4980	csrss.exe
2480	csrss.exe
2044	csrss.exe
516	csrss.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	116	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	4620	csrss.exe
Token: SeDebugPrivilege	544	csrss.exe
Token: SeDebugPrivilege	4716	csrss.exe
Token: SeDebugPrivilege	2572	csrss.exe
Token: SeDebugPrivilege	4072	csrss.exe
Token: SeDebugPrivilege	3368	csrss.exe
Token: SeDebugPrivilege	1964	csrss.exe
Token: SeDebugPrivilege	1468	csrss.exe
Token: SeDebugPrivilege	4980	csrss.exe
Token: SeDebugPrivilege	2480	csrss.exe
Token: SeDebugPrivilege	2044	csrss.exe
Token: SeDebugPrivilege	516	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exetmpA6C2.tmp.execsrss.exetmpDD50.tmp.exeWScript.execsrss.exetmpFABB.tmp.exe

description	pid	Process	procid_target
PID 3076 wrote to memory of 1004	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	134
PID 3076 wrote to memory of 1004	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	134
PID 3076 wrote to memory of 1004	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	134
PID 1004 wrote to memory of 3436	1004	tmpA6C2.tmp.exe	136
PID 1004 wrote to memory of 3436	1004	tmpA6C2.tmp.exe	136
PID 1004 wrote to memory of 3436	1004	tmpA6C2.tmp.exe	136
PID 1004 wrote to memory of 3436	1004	tmpA6C2.tmp.exe	136
PID 1004 wrote to memory of 3436	1004	tmpA6C2.tmp.exe	136
PID 1004 wrote to memory of 3436	1004	tmpA6C2.tmp.exe	136
PID 1004 wrote to memory of 3436	1004	tmpA6C2.tmp.exe	136
PID 3076 wrote to memory of 4424	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	143
PID 3076 wrote to memory of 4424	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	143
PID 3076 wrote to memory of 2176	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	144
PID 3076 wrote to memory of 2176	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	144
PID 3076 wrote to memory of 4024	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	145
PID 3076 wrote to memory of 4024	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	145
PID 3076 wrote to memory of 116	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	146
PID 3076 wrote to memory of 116	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	146
PID 3076 wrote to memory of 4868	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	147
PID 3076 wrote to memory of 4868	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	147
PID 3076 wrote to memory of 3268	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	148
PID 3076 wrote to memory of 3268	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	148
PID 3076 wrote to memory of 3916	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	149
PID 3076 wrote to memory of 3916	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	149
PID 3076 wrote to memory of 2240	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	150
PID 3076 wrote to memory of 2240	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	150
PID 3076 wrote to memory of 2388	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	151
PID 3076 wrote to memory of 2388	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	151
PID 3076 wrote to memory of 1312	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	152
PID 3076 wrote to memory of 1312	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	152
PID 3076 wrote to memory of 4980	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	153
PID 3076 wrote to memory of 4980	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	153
PID 3076 wrote to memory of 4620	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	165
PID 3076 wrote to memory of 4620	3076	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe	165
PID 4620 wrote to memory of 5020	4620	csrss.exe	166
PID 4620 wrote to memory of 5020	4620	csrss.exe	166
PID 4620 wrote to memory of 3428	4620	csrss.exe	167
PID 4620 wrote to memory of 3428	4620	csrss.exe	167
PID 4620 wrote to memory of 4280	4620	csrss.exe	168
PID 4620 wrote to memory of 4280	4620	csrss.exe	168
PID 4620 wrote to memory of 4280	4620	csrss.exe	168
PID 4280 wrote to memory of 696	4280	tmpDD50.tmp.exe	170
PID 4280 wrote to memory of 696	4280	tmpDD50.tmp.exe	170
PID 4280 wrote to memory of 696	4280	tmpDD50.tmp.exe	170
PID 4280 wrote to memory of 696	4280	tmpDD50.tmp.exe	170
PID 4280 wrote to memory of 696	4280	tmpDD50.tmp.exe	170
PID 4280 wrote to memory of 696	4280	tmpDD50.tmp.exe	170
PID 4280 wrote to memory of 696	4280	tmpDD50.tmp.exe	170
PID 5020 wrote to memory of 544	5020	WScript.exe	171
PID 5020 wrote to memory of 544	5020	WScript.exe	171
PID 544 wrote to memory of 5024	544	csrss.exe	172
PID 544 wrote to memory of 5024	544	csrss.exe	172
PID 544 wrote to memory of 2720	544	csrss.exe	173
PID 544 wrote to memory of 2720	544	csrss.exe	173
PID 544 wrote to memory of 4704	544	csrss.exe	174
PID 544 wrote to memory of 4704	544	csrss.exe	174
PID 544 wrote to memory of 4704	544	csrss.exe	174
PID 4704 wrote to memory of 1324	4704	tmpFABB.tmp.exe	176
PID 4704 wrote to memory of 1324	4704	tmpFABB.tmp.exe	176
PID 4704 wrote to memory of 1324	4704	tmpFABB.tmp.exe	176
PID 4704 wrote to memory of 1324	4704	tmpFABB.tmp.exe	176
PID 4704 wrote to memory of 1324	4704	tmpFABB.tmp.exe	176
PID 4704 wrote to memory of 1324	4704	tmpFABB.tmp.exe	176
PID 4704 wrote to memory of 1324	4704	tmpFABB.tmp.exe	176

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

Processes:

930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe
"C:\Users\Admin\AppData\Local\Temp\930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3076
- C:\Users\Admin\AppData\Local\Temp\tmpA6C2.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpA6C2.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Users\Admin\AppData\Local\Temp\tmpA6C2.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpA6C2.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:3436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Program Files\Common Files\DESIGNER\csrss.exe
  "C:\Program Files\Common Files\DESIGNER\csrss.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4620
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\16885c37-ff7c-4169-9279-2cbb594e18b4.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Program Files\Common Files\DESIGNER\csrss.exe
      "C:\Program Files\Common Files\DESIGNER\csrss.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:544
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\822d10c6-e8fd-4a98-8c64-97de6972f8ba.vbs"
        5⤵
        
        PID:5024
      - C:\Program Files\Common Files\DESIGNER\csrss.exe
        
        "C:\Program Files\Common Files\DESIGNER\csrss.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0ed32d1-0343-43ab-b0c2-ab9c2f192e77.vbs"
        7⤵
        
        PID:2456
        
        C:\Program Files\Common Files\DESIGNER\csrss.exe
        
        "C:\Program Files\Common Files\DESIGNER\csrss.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c83b9d81-ce2d-4c4b-b316-5938287b2bf6.vbs"
        9⤵
        
        PID:1464
        
        C:\Program Files\Common Files\DESIGNER\csrss.exe
        
        "C:\Program Files\Common Files\DESIGNER\csrss.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4072
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38d715b3-5562-4c59-9a7d-03460cce29a6.vbs"
        11⤵
        
        PID:228
        
        C:\Program Files\Common Files\DESIGNER\csrss.exe
        
        "C:\Program Files\Common Files\DESIGNER\csrss.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd885d1d-a0f0-448c-a9d0-c73ddddf725d.vbs"
        13⤵
        
        PID:4964
        
        C:\Program Files\Common Files\DESIGNER\csrss.exe
        
        "C:\Program Files\Common Files\DESIGNER\csrss.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec55b676-0d12-4a57-81e6-6a3ae3fbf713.vbs"
        15⤵
        
        PID:700
        
        C:\Program Files\Common Files\DESIGNER\csrss.exe
        
        "C:\Program Files\Common Files\DESIGNER\csrss.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1468
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a7eb062-181a-4a12-9939-3ba7ee081625.vbs"
        17⤵
        
        PID:2928
        
        C:\Program Files\Common Files\DESIGNER\csrss.exe
        
        "C:\Program Files\Common Files\DESIGNER\csrss.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a7892f9-badf-422f-b8d1-4d4738b45195.vbs"
        19⤵
        
        PID:4984
        
        C:\Program Files\Common Files\DESIGNER\csrss.exe
        
        "C:\Program Files\Common Files\DESIGNER\csrss.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc58c3ad-d910-48bf-9e02-96848c8bdcf0.vbs"
        21⤵
        
        PID:1700
        
        C:\Program Files\Common Files\DESIGNER\csrss.exe
        
        "C:\Program Files\Common Files\DESIGNER\csrss.exe"
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3c8db79-cf88-48ce-8756-8c413b08d962.vbs"
        23⤵
        
        PID:4484
        
        C:\Program Files\Common Files\DESIGNER\csrss.exe
        
        "C:\Program Files\Common Files\DESIGNER\csrss.exe"
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a3ef207-180e-498b-8b52-e66e9a4f6bd2.vbs"
        23⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\tmp5B74.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5B74.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\tmp5B74.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5B74.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:2980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90d4709e-fb69-456c-9e48-84f0dad94669.vbs"
        21⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\tmp3F13.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3F13.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\tmp3F13.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3F13.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4d79372-ab04-4b81-b6a1-837ed042dd3d.vbs"
        19⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\tmp2215.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2215.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\tmp2215.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2215.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33c0ef89-fa9e-4feb-918d-14b1bad787fc.vbs"
        17⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\tmpF1ED.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF1ED.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\tmpF1ED.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF1ED.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:2540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0eb03b0b-290a-43fa-ab9d-7791705dae40.vbs"
        15⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\tmpC241.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC241.tmp.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\tmpC241.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC241.tmp.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\tmpC241.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC241.tmp.exe"
        17⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb2533c7-5b34-497a-bdf6-14d95d6cc51b.vbs"
        13⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\tmp9323.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9323.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\tmp9323.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9323.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3c9348c-6233-46c7-a493-eb55a3329e83.vbs"
        11⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\tmp7700.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7700.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\tmp7700.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7700.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3fb5c441-e857-4f7c-b0db-3d2143cdcc1b.vbs"
        9⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\tmp5BA8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5BA8.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\tmp5BA8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5BA8.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b9fbf75-6f58-4d17-afe7-f7277ac9031c.vbs"
        7⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\tmp3F08.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3F08.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\tmp3F08.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3F08.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:4020
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6464bb9f-8f29-4f59-af26-c66b8bf8e766.vbs"
        5⤵
        
        PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\tmpFABB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFABB.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\tmpFABB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFABB.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:1324
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3f96ac39-0e57-498b-b710-31460cda1286.vbs"
    3⤵
    PID:3428
- - C:\Users\Admin\AppData\Local\Temp\tmpDD50.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpDD50.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\tmpDD50.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpDD50.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Downloaded Program Files\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\Downloaded Program Files\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\PolicyDefinitions\es-ES\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\PolicyDefinitions\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Music\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Music\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\DESIGNER\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\DESIGNER\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\ssh\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\es-ES\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\RemoteApps\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\RemoteApps\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\InputMethod\SHARED\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\InputMethod\SHARED\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\DESIGNER\csrss.exe

Filesize
4.9MB

MD5
23cf25a557334a68c58b37dcb243b585

SHA1
5f3de683c9d3745d38b3a9cf267a015be9e5d360

SHA256
d73324b661817853b99f95295a1778d05cb4fe1f9dd58ff8916e09e5c714559a

SHA512
d84930e6cd9d6b9c70f9e7ea5d5bb75888d66c57fe5112c0f678203474f4d53b477910d11e40c26da170ea737087e04cab88976f05187b8e69a4ad7601bda9fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\16885c37-ff7c-4169-9279-2cbb594e18b4.vbs

Filesize
724B

MD5
3b9a34ada1378870e071de4d6377069a

SHA1
fd7e521e55a428c1a110ecdb6ba8aa83c9b7214f

SHA256
0af9e3cb674b1039bbfc6b66589f4c1c442a0c041988ceab54b9043ea2ab4c7a

SHA512
7c3c2f8b913d0bac50501e3e8b77ac63d1da47ed90c9a730337436c78011aecf1792f65a4f5f4a53c76b0b76f0538b8582e09fbb22dff14f127d3ecb2145ec42

Download Submit
C:\Users\Admin\AppData\Local\Temp\38d715b3-5562-4c59-9a7d-03460cce29a6.vbs

Filesize
724B

MD5
1c5da4e257566879f6fd686a66f4db12

SHA1
1a367bfb1c1e7b084e1b3f411540324ae8c4eac8

SHA256
2f0c72b2f84be5c53e700e85d674f92fea478a464e3518031a59c3028ac6a821

SHA512
3615c588c94578bda6d7a3c5381d4f034f887d1d7fe13659b87850107d5daf1ab3fb954791a49fbeb7e645d7659b0a878becf1796cdaa0a3e7711299a69b2e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\3f96ac39-0e57-498b-b710-31460cda1286.vbs

Filesize
500B

MD5
a0d7923fd2b8264638efcf7e96f19ad0

SHA1
d84b7d9170b53abb126938ca89da92a798f6a438

SHA256
9673126e3cb0300284b6c54870fc26b326a29876075496de69f7ecc5a529b32e

SHA512
46f3c51a8f17f586b503eeed021a01ea1602e9f81b2d6f04839e6a8a27be87caf58293e7d07cfcf6385a5223a813f4d6309850192d642f6b1a47b9c5284af7c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\822d10c6-e8fd-4a98-8c64-97de6972f8ba.vbs

Filesize
723B

MD5
897ede0d416624e2c9fa6f29f3f9749f

SHA1
468a97f28796087350eda32be55542e5f0f85047

SHA256
5eb85acc691cd1349b8a490d074445af92c66012b6554b727684c5288e510c5a

SHA512
9955714fa8859fe8c0ebe361ca9675b6736fa974b89de76f33d56b2c18344fb9f2376aa83375ca61fa315e1d03cf18d16d82c56608bfdd6b5aa99d0843a58219

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5caha250.tck.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c83b9d81-ce2d-4c4b-b316-5938287b2bf6.vbs

Filesize
724B

MD5
e0b8e13cea19f1fe6020674b1edc6148

SHA1
8f749f76cc2ed81a73ae3a5fdbb916744a8414a6

SHA256
5c149318e3c1ed12102fc840d5eca9debfa0fd9f62fdd26a664cb5fede45eb1d

SHA512
0f93eab981e45d3139a15a664829a1c57fffd5624db4da1b69bd812d800ed257ee26e4e0805eb29e06e488d2afce238e167d38fce7ee4e83060901d1a655af48

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd885d1d-a0f0-448c-a9d0-c73ddddf725d.vbs

Filesize
724B

MD5
a46cd4b6f2e06c15104fd169b467cd79

SHA1
ba7e6e9e2cd58c778b5f88be50d6fa018cba2359

SHA256
7ab989f47455cb9da2edadca7bc18b6d7bc8888468c5a65a8233cafd95238cc2

SHA512
0967db68c30f9940dfd88e86aee02ac79d53e53275229bc3166fcc4e0bd568f22e77ed3638e672a3f37fa9830341eddb5b7c4aed2c68a23d4942fbcca003aecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec55b676-0d12-4a57-81e6-6a3ae3fbf713.vbs

Filesize
724B

MD5
ba65abfe47cc54982a46e0b75c9e6f51

SHA1
bc33d13afa24e7ad0579a3ad12d60a0dc85b24a2

SHA256
27ee7a242ebdeb67581cc9b737d0c0aff2102f51b193321ffa7ed127c3579803

SHA512
0375ecad9a7ed45c174befce0f7bd3d51bac3d62d515d44e05e3bb966090345989a722f549b0b4339f121bd8a6c461ef2f461fbf42dd7f06c9712a60ec06a964

Download Submit
C:\Users\Admin\AppData\Local\Temp\f0ed32d1-0343-43ab-b0c2-ab9c2f192e77.vbs

Filesize
724B

MD5
e2ef1769da397a97f69b2eebbc9c1c2b

SHA1
ac3c363b47c762694f48e01c751756c279a66fd3

SHA256
38e04764bd94086497ff4e0710066778bdff6eb0e6ed6b131ddf6b258186e748

SHA512
c1c198cd268f86ebb167c3b0744256e34eec73a80150b9356954b2b88023a0b6693a167eddd92e7826f42522972b77206167d739068a0cc7bef5d5e0841af5a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA6C2.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Public\Music\spoolsv.exe

Filesize
4.9MB

MD5
5103a1bb4e59cbcc9d05cc7905681c9f

SHA1
2ef27ea1ad70d19c214586cf8f44a03853c6fdf1

SHA256
930040236d537be63b44b58c59f263d25d9af869abedff8e80d87157b99a6246

SHA512
fc6aef981ab43609850d0b2e79fa4d22646c439f12a267b177b00a67afc1879000f195f1677b24f60250bc8839c4825294b094a902fece31942e8b8ef0ecf33a

Download Submit
C:\Windows\PolicyDefinitions\es-ES\dllhost.exe

Filesize
4.9MB

MD5
93fe37de751a04f02d07e89d0c5e04e8

SHA1
e5273ba16911bb5ae2d95ce360f7664747144417

SHA256
aba3d445487b31a8b02d6616e9e58facded8a277716d82b041a45e9aa4390e94

SHA512
4de9310c45177a2c7bddcfb33303e717bc11fd1e0fa2dc9adba62ee13f7a6cd45f6157291e494b4a7211d1ad21071ce8a721124ebc6ae48b17c885ced4a8027c

Download Submit
memory/544-408-0x000000001DEE0000-0x000000001DFE2000-memory.dmp

Filesize
1.0MB

Download
memory/2044-580-0x000000001D7F0000-0x000000001D802000-memory.dmp

Filesize
72KB

Download
memory/2572-435-0x000000001D9F0000-0x000000001DA02000-memory.dmp

Filesize
72KB

Download
memory/2572-458-0x000000001DEB0000-0x000000001DFB2000-memory.dmp

Filesize
1.0MB

Download
memory/3076-1-0x00000000001F0000-0x00000000006E4000-memory.dmp

Filesize
5.0MB

Download
memory/3076-16-0x0000000002950000-0x0000000002958000-memory.dmp

Filesize
32KB

Download
memory/3076-153-0x00007FF814CB0000-0x00007FF815771000-memory.dmp

Filesize
10.8MB

Download
memory/3076-10-0x00000000028B0000-0x00000000028BA000-memory.dmp

Filesize
40KB

Download
memory/3076-12-0x000000001C1C0000-0x000000001C6E8000-memory.dmp

Filesize
5.2MB

Download
memory/3076-11-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/3076-18-0x000000001BC90000-0x000000001BC9C000-memory.dmp

Filesize
48KB

Download
memory/3076-336-0x00007FF814CB0000-0x00007FF815771000-memory.dmp

Filesize
10.8MB

Download
memory/3076-8-0x0000000002880000-0x0000000002896000-memory.dmp

Filesize
88KB

Download
memory/3076-9-0x00000000028A0000-0x00000000028B0000-memory.dmp

Filesize
64KB

Download
memory/3076-7-0x0000000002870000-0x0000000002880000-memory.dmp

Filesize
64KB

Download
memory/3076-139-0x00007FF814CB3000-0x00007FF814CB5000-memory.dmp

Filesize
8KB

Download
memory/3076-5-0x00000000028C0000-0x0000000002910000-memory.dmp

Filesize
320KB

Download
memory/3076-6-0x0000000001010000-0x0000000001018000-memory.dmp

Filesize
32KB

Download
memory/3076-4-0x0000000000FF0000-0x000000000100C000-memory.dmp

Filesize
112KB

Download
memory/3076-13-0x0000000002920000-0x000000000292A000-memory.dmp

Filesize
40KB

Download
memory/3076-3-0x00007FF814CB0000-0x00007FF815771000-memory.dmp

Filesize
10.8MB

Download
memory/3076-2-0x000000001B540000-0x000000001B66E000-memory.dmp

Filesize
1.2MB

Download
memory/3076-17-0x000000001B670000-0x000000001B678000-memory.dmp

Filesize
32KB

Download
memory/3076-15-0x0000000002940000-0x000000000294E000-memory.dmp

Filesize
56KB

Download
memory/3076-14-0x0000000002930000-0x000000000293E000-memory.dmp

Filesize
56KB

Download
memory/3076-0-0x00007FF814CB3000-0x00007FF814CB5000-memory.dmp

Filesize
8KB

Download
memory/3268-229-0x00000181A7ED0000-0x00000181A7EF2000-memory.dmp

Filesize
136KB

Download
memory/3368-506-0x000000001DB00000-0x000000001DC02000-memory.dmp

Filesize
1.0MB

Download
memory/3436-78-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4072-482-0x000000001DC40000-0x000000001DD42000-memory.dmp

Filesize
1.0MB

Download
memory/4620-383-0x000000001DCB0000-0x000000001DDB2000-memory.dmp

Filesize
1.0MB

Download
memory/4620-356-0x000000001D7F0000-0x000000001D802000-memory.dmp

Filesize
72KB

Download
memory/4620-335-0x0000000000B50000-0x0000000001044000-memory.dmp

Filesize
5.0MB

Download
memory/4716-433-0x000000001E060000-0x000000001E162000-memory.dmp

Filesize
1.0MB

Download
memory/4716-410-0x000000001DBF0000-0x000000001DC02000-memory.dmp

Filesize
72KB

Download