colibri | 4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742

Analysis

max time kernel
119s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Size

4.9MB
MD5

1942a319d1a63f4329b9a218916e7bb0
SHA1

67d8341f0b49c19debbfe1ad450464eca5c03eb5
SHA256

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742
SHA512

9fda304f1093a8bc94d52133076b1b4321f9d99afc98c26670c22355b337c373a7d22a8ddf967d0d503e0cb42fb5efb36f81506ea7279b5377ec274562ce30c7
SSDEEP

49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	1168	schtasks.exe	83

UAC bypass 3 TTPs 36 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

taskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exe4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/2752-2-0x000000001BDE0000-0x000000001BF0E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2780	powershell.exe
4040	powershell.exe
3136	powershell.exe
2664	powershell.exe
4480	powershell.exe
3084	powershell.exe
4372	powershell.exe
756	powershell.exe
2360	powershell.exe
1860	powershell.exe
452	powershell.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskhostw.exe4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe

Executes dropped EXE 34 IoCs

Processes:

tmpA098.tmp.exetmpA098.tmp.exetaskhostw.exetmpCCC6.tmp.exetmpCCC6.tmp.exetaskhostw.exetmp191.tmp.exetmp191.tmp.exetaskhostw.exetmp3294.tmp.exetmp3294.tmp.exetmp3294.tmp.exetaskhostw.exetaskhostw.exetmp80A5.tmp.exetmp80A5.tmp.exetaskhostw.exetmpB253.tmp.exetmpB253.tmp.exetmpB253.tmp.exetaskhostw.exetmpE52B.tmp.exetmpE52B.tmp.exetaskhostw.exetmp17D.tmp.exetmp17D.tmp.exetmp17D.tmp.exetaskhostw.exetmp1DB0.tmp.exetmp1DB0.tmp.exetaskhostw.exetmp4D2C.tmp.exetmp4D2C.tmp.exetaskhostw.exe

pid	Process
4916	tmpA098.tmp.exe
4612	tmpA098.tmp.exe
5056	taskhostw.exe
1772	tmpCCC6.tmp.exe
756	tmpCCC6.tmp.exe
4900	taskhostw.exe
4256	tmp191.tmp.exe
2716	tmp191.tmp.exe
832	taskhostw.exe
4580	tmp3294.tmp.exe
396	tmp3294.tmp.exe
3656	tmp3294.tmp.exe
1440	taskhostw.exe
3180	taskhostw.exe
4376	tmp80A5.tmp.exe
2720	tmp80A5.tmp.exe
4848	taskhostw.exe
1572	tmpB253.tmp.exe
4692	tmpB253.tmp.exe
4700	tmpB253.tmp.exe
380	taskhostw.exe
1644	tmpE52B.tmp.exe
4972	tmpE52B.tmp.exe
2968	taskhostw.exe
1008	tmp17D.tmp.exe
3620	tmp17D.tmp.exe
516	tmp17D.tmp.exe
3980	taskhostw.exe
4848	tmp1DB0.tmp.exe
1684	tmp1DB0.tmp.exe
868	taskhostw.exe
456	tmp4D2C.tmp.exe
2296	tmp4D2C.tmp.exe
2420	taskhostw.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

taskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exe4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe

Drops file in System32 directory 4 IoCs

Processes:

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\sr-Latn-RS\dllhost.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Windows\System32\sr-Latn-RS\dllhost.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Windows\System32\sr-Latn-RS\5940a34987c991	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Windows\System32\sr-Latn-RS\RCXA6C5.tmp	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

tmpA098.tmp.exetmpCCC6.tmp.exetmp191.tmp.exetmp3294.tmp.exetmp80A5.tmp.exetmpB253.tmp.exetmpE52B.tmp.exetmp17D.tmp.exetmp1DB0.tmp.exetmp4D2C.tmp.exe

description	pid	Process	procid_target
PID 4916 set thread context of 4612	4916	tmpA098.tmp.exe	125
PID 1772 set thread context of 756	1772	tmpCCC6.tmp.exe	166
PID 4256 set thread context of 2716	4256	tmp191.tmp.exe	175
PID 396 set thread context of 3656	396	tmp3294.tmp.exe	189
PID 4376 set thread context of 2720	4376	tmp80A5.tmp.exe	204
PID 4692 set thread context of 4700	4692	tmpB253.tmp.exe	215
PID 1644 set thread context of 4972	1644	tmpE52B.tmp.exe	224
PID 3620 set thread context of 516	3620	tmp17D.tmp.exe	234
PID 4848 set thread context of 1684	4848	tmp1DB0.tmp.exe	244
PID 456 set thread context of 2296	456	tmp4D2C.tmp.exe	253

Drops file in Program Files directory 16 IoCs

Processes:

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe

description	ioc	Process
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\RCXAF84.tmp	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\System.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Program Files\Java\jdk-1.8\e6c9b481da804f	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Program Files (x86)\Internet Explorer\dwm.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\27d1bcfc3c54e0	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\RCXA068.tmp	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\dllhost.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Program Files\Java\jdk-1.8\OfficeClickToRun.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Program Files (x86)\Internet Explorer\6cb0b6c459d5d3	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\dllhost.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\System.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\5940a34987c991	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\OfficeClickToRun.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCXAD6F.tmp	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCXB842.tmp	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\dwm.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe

Drops file in Windows directory 13 IoCs

Processes:

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe

description	ioc	Process
File created	C:\Windows\Provisioning\4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Windows\L2Schemas\SppExtComObj.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\taskhostw.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Windows\L2Schemas\RCXB62E.tmp	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Windows\L2Schemas\SppExtComObj.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Windows\Provisioning\RCXA4B1.tmp	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Windows\Provisioning\4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCXA947.tmp	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Windows\LanguageOverlayCache\backgroundTaskHost.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Windows\Provisioning\40dffb21c58e7c	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Windows\Prefetch\ReadyBoot\taskhostw.exe	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Windows\Prefetch\ReadyBoot\ea9f0e6c9e2dcd	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
File created	C:\Windows\L2Schemas\e1ef82546f0b02	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

tmpCCC6.tmp.exetmp191.tmp.exetmp80A5.tmp.exetmpB253.tmp.exetmp1DB0.tmp.exetmp4D2C.tmp.exetmpA098.tmp.exetmp3294.tmp.exetmp3294.tmp.exetmpB253.tmp.exetmpE52B.tmp.exetmp17D.tmp.exetmp17D.tmp.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCCC6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp191.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp80A5.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB253.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1DB0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4D2C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA098.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3294.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3294.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB253.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE52B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp17D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp17D.tmp.exe

Modifies registry class 12 IoCs

Processes:

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
1972	schtasks.exe
2224	schtasks.exe
1388	schtasks.exe
1580	schtasks.exe
3652	schtasks.exe
3924	schtasks.exe
4576	schtasks.exe
868	schtasks.exe
4408	schtasks.exe
4880	schtasks.exe
4692	schtasks.exe
3516	schtasks.exe
3856	schtasks.exe
4892	schtasks.exe
3052	schtasks.exe
840	schtasks.exe
4936	schtasks.exe
3648	schtasks.exe
2040	schtasks.exe
3364	schtasks.exe
4152	schtasks.exe
4064	schtasks.exe
4000	schtasks.exe
5032	schtasks.exe
3584	schtasks.exe
2956	schtasks.exe
2128	schtasks.exe
224	schtasks.exe
4872	schtasks.exe
2292	schtasks.exe
1000	schtasks.exe
2760	schtasks.exe
1984	schtasks.exe
3456	schtasks.exe
2444	schtasks.exe
3752	schtasks.exe
4360	schtasks.exe
3348	schtasks.exe
2260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetaskhostw.exetaskhostw.exetaskhostw.exe

pid	Process
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
2664	powershell.exe
2664	powershell.exe
4040	powershell.exe
4040	powershell.exe
452	powershell.exe
452	powershell.exe
2780	powershell.exe
2780	powershell.exe
756	powershell.exe
756	powershell.exe
2360	powershell.exe
2360	powershell.exe
4480	powershell.exe
4480	powershell.exe
4372	powershell.exe
4372	powershell.exe
1860	powershell.exe
1860	powershell.exe
3136	powershell.exe
3136	powershell.exe
3084	powershell.exe
3084	powershell.exe
2664	powershell.exe
452	powershell.exe
3136	powershell.exe
4040	powershell.exe
1860	powershell.exe
756	powershell.exe
3084	powershell.exe
4480	powershell.exe
4372	powershell.exe
2780	powershell.exe
2360	powershell.exe
5056	taskhostw.exe
4900	taskhostw.exe
832	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	3084	powershell.exe
Token: SeDebugPrivilege	5056	taskhostw.exe
Token: SeDebugPrivilege	4900	taskhostw.exe
Token: SeDebugPrivilege	832	taskhostw.exe
Token: SeDebugPrivilege	1440	taskhostw.exe
Token: SeDebugPrivilege	3180	taskhostw.exe
Token: SeDebugPrivilege	4848	taskhostw.exe
Token: SeDebugPrivilege	380	taskhostw.exe
Token: SeDebugPrivilege	2968	taskhostw.exe
Token: SeDebugPrivilege	3980	taskhostw.exe
Token: SeDebugPrivilege	868	taskhostw.exe
Token: SeDebugPrivilege	2420	taskhostw.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exetmpA098.tmp.exetaskhostw.exetmpCCC6.tmp.exeWScript.exetaskhostw.exetmp191.tmp.exe

description	pid	Process	procid_target
PID 2752 wrote to memory of 4916	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	123
PID 2752 wrote to memory of 4916	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	123
PID 2752 wrote to memory of 4916	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	123
PID 4916 wrote to memory of 4612	4916	tmpA098.tmp.exe	125
PID 4916 wrote to memory of 4612	4916	tmpA098.tmp.exe	125
PID 4916 wrote to memory of 4612	4916	tmpA098.tmp.exe	125
PID 4916 wrote to memory of 4612	4916	tmpA098.tmp.exe	125
PID 4916 wrote to memory of 4612	4916	tmpA098.tmp.exe	125
PID 4916 wrote to memory of 4612	4916	tmpA098.tmp.exe	125
PID 4916 wrote to memory of 4612	4916	tmpA098.tmp.exe	125
PID 2752 wrote to memory of 3136	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	132
PID 2752 wrote to memory of 3136	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	132
PID 2752 wrote to memory of 2664	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	133
PID 2752 wrote to memory of 2664	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	133
PID 2752 wrote to memory of 4480	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	134
PID 2752 wrote to memory of 4480	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	134
PID 2752 wrote to memory of 3084	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	135
PID 2752 wrote to memory of 3084	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	135
PID 2752 wrote to memory of 756	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	136
PID 2752 wrote to memory of 756	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	136
PID 2752 wrote to memory of 2360	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	137
PID 2752 wrote to memory of 2360	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	137
PID 2752 wrote to memory of 1860	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	138
PID 2752 wrote to memory of 1860	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	138
PID 2752 wrote to memory of 2780	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	139
PID 2752 wrote to memory of 2780	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	139
PID 2752 wrote to memory of 452	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	140
PID 2752 wrote to memory of 452	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	140
PID 2752 wrote to memory of 4372	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	141
PID 2752 wrote to memory of 4372	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	141
PID 2752 wrote to memory of 4040	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	142
PID 2752 wrote to memory of 4040	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	142
PID 2752 wrote to memory of 5056	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	154
PID 2752 wrote to memory of 5056	2752	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe	154
PID 5056 wrote to memory of 4432	5056	taskhostw.exe	158
PID 5056 wrote to memory of 4432	5056	taskhostw.exe	158
PID 5056 wrote to memory of 4456	5056	taskhostw.exe	159
PID 5056 wrote to memory of 4456	5056	taskhostw.exe	159
PID 5056 wrote to memory of 1772	5056	taskhostw.exe	163
PID 5056 wrote to memory of 1772	5056	taskhostw.exe	163
PID 5056 wrote to memory of 1772	5056	taskhostw.exe	163
PID 1772 wrote to memory of 756	1772	tmpCCC6.tmp.exe	166
PID 1772 wrote to memory of 756	1772	tmpCCC6.tmp.exe	166
PID 1772 wrote to memory of 756	1772	tmpCCC6.tmp.exe	166
PID 1772 wrote to memory of 756	1772	tmpCCC6.tmp.exe	166
PID 1772 wrote to memory of 756	1772	tmpCCC6.tmp.exe	166
PID 1772 wrote to memory of 756	1772	tmpCCC6.tmp.exe	166
PID 1772 wrote to memory of 756	1772	tmpCCC6.tmp.exe	166
PID 4432 wrote to memory of 4900	4432	WScript.exe	169
PID 4432 wrote to memory of 4900	4432	WScript.exe	169
PID 4900 wrote to memory of 1612	4900	taskhostw.exe	171
PID 4900 wrote to memory of 1612	4900	taskhostw.exe	171
PID 4900 wrote to memory of 2360	4900	taskhostw.exe	172
PID 4900 wrote to memory of 2360	4900	taskhostw.exe	172
PID 4900 wrote to memory of 4256	4900	taskhostw.exe	173
PID 4900 wrote to memory of 4256	4900	taskhostw.exe	173
PID 4900 wrote to memory of 4256	4900	taskhostw.exe	173
PID 4256 wrote to memory of 2716	4256	tmp191.tmp.exe	175
PID 4256 wrote to memory of 2716	4256	tmp191.tmp.exe	175
PID 4256 wrote to memory of 2716	4256	tmp191.tmp.exe	175
PID 4256 wrote to memory of 2716	4256	tmp191.tmp.exe	175
PID 4256 wrote to memory of 2716	4256	tmp191.tmp.exe	175
PID 4256 wrote to memory of 2716	4256	tmp191.tmp.exe	175
PID 4256 wrote to memory of 2716	4256	tmp191.tmp.exe	175

System policy modification 1 TTPs 36 IoCs

evasion

Modify Registry

T1112

Processes:

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe
"C:\Users\Admin\AppData\Local\Temp\4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2752
- C:\Users\Admin\AppData\Local\Temp\tmpA098.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpA098.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\tmpA098.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpA098.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:4612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
  "C:\Windows\Prefetch\ReadyBoot\taskhostw.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5056
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91e580cc-f3fa-4a90-8d68-2ec42ea80120.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
      C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4900
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7845ce94-4b9f-4fe9-928d-0db3aa179cd6.vbs"
        5⤵
        
        PID:1612
      - C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:832
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9e50182-e8c4-4bbd-91f4-2d8e22b00086.vbs"
        7⤵
        
        PID:4196
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6a96a9b-e3c7-41de-b977-ef50515326c1.vbs"
        9⤵
        
        PID:4128
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3180
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a07c9c15-87af-4bdf-a0ca-857a319917fa.vbs"
        11⤵
        
        PID:4964
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8b1528a-f4fa-4454-b330-43a36e0704b3.vbs"
        13⤵
        
        PID:4140
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\359c0049-cd8f-4c5d-ae2c-e1ea79d33189.vbs"
        15⤵
        
        PID:2888
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4da51fa2-84d6-4983-b634-ee18b6ab306f.vbs"
        17⤵
        
        PID:3180
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f18ec0c0-fc5d-4bdc-84fd-16e4c4ef03eb.vbs"
        19⤵
        
        PID:4560
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef534d67-3a96-4aa2-92b3-6baf01e11f5d.vbs"
        21⤵
        
        PID:896
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        
        C:\Windows\Prefetch\ReadyBoot\taskhostw.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6e158ae-4d82-4f64-bf10-e21562703745.vbs"
        23⤵
        
        PID:4884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be81fd61-1b8b-48d1-a744-dc06aa4c923c.vbs"
        23⤵
        
        PID:1820
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd6f981b-d9fc-4006-bb2b-d98699502c23.vbs"
        21⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\tmp4D2C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4D2C.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\tmp4D2C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4D2C.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e9945da-2421-4c39-835c-cfb7c54f93b8.vbs"
        19⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\tmp1DB0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1DB0.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\tmp1DB0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1DB0.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:1684
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3053d38e-4e23-4cdb-ab18-677ba6cc6dc0.vbs"
        17⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\tmp17D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp17D.tmp.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\tmp17D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp17D.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\tmp17D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp17D.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\808ac179-f85e-4021-919e-75d640f20bf6.vbs"
        15⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\tmpE52B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE52B.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\tmpE52B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE52B.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f2b6ce1-80a2-4753-b99e-62ae17e1ef79.vbs"
        13⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\tmpB253.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB253.tmp.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\tmpB253.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB253.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\tmpB253.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpB253.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc713826-e7ad-4871-8128-776acea06620.vbs"
        11⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\tmp80A5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp80A5.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\tmp80A5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp80A5.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:2720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2f84dc4-f100-40d0-a798-51834cee3a46.vbs"
        9⤵
        
        PID:2036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c50eeb13-d62c-44a4-8223-d471b1d67e9e.vbs"
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\tmp3294.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3294.tmp.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\tmp3294.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3294.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\tmp3294.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3294.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:3656
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7dfb5266-2da6-46c3-b61a-b9abb71cb216.vbs"
        5⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\tmp191.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp191.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\tmp191.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp191.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:2716
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e0e6cb3c-a5ea-413c-943f-2c4397b68853.vbs"
    3⤵
    PID:4456
- - C:\Users\Admin\AppData\Local\Temp\tmpCCC6.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpCCC6.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\tmpCCC6.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpCCC6.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jdk-1.8\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jdk-1.8\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N4" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N" /sc ONLOGON /tr "'C:\Windows\Provisioning\4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N4" /sc MINUTE /mo 11 /tr "'C:\Windows\Provisioning\4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\System32\sr-Latn-RS\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\sr-Latn-RS\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\System32\sr-Latn-RS\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Windows\Prefetch\ReadyBoot\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Windows\Prefetch\ReadyBoot\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\L2Schemas\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\359c0049-cd8f-4c5d-ae2c-e1ea79d33189.vbs

Filesize
718B

MD5
c58b7e5c337704110aeab6472addf7bf

SHA1
40fd497c8cf9bb61b130eb166e10286663276dc6

SHA256
b1ec66c4b05df4954372237366914e75f71af0c7bb167da436a836ef10695f20

SHA512
52443f604bf817ce66e6a0e850056281b7582abab2080ea23073d94a8fceaf5f0e7d9bbc92c7fd3c78ef0ae569f87271a5207734ce94f00ca9a7a7abc95d42e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7845ce94-4b9f-4fe9-928d-0db3aa179cd6.vbs

Filesize
719B

MD5
9d5ff5d5efb4dd2c6ac35275fab1bc42

SHA1
a6c63c008ebd9114186d57f07387c95c8e96d04d

SHA256
a14d8f40c884d59e87b3e37f7abe192b0cff2242be24906548ccff765bcca7f2

SHA512
ca0349379184f4c04bd675eca609d66952a9539f7a1dbf216852faec2c257c2f6246575b6cd9c74d87c3ba01c718f05ecfda67111dd56503ae2e841632afd2d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\91e580cc-f3fa-4a90-8d68-2ec42ea80120.vbs

Filesize
719B

MD5
eb9e73f4a46894278f148ccf449593f7

SHA1
2b64f6c7f6dcb3e4376c54edab16c5ab3438fd84

SHA256
7af2d2f29a7278e81399ef80e68f15a1db0e208f3426088badc43faf0382a303

SHA512
28bfd0657b9678f0d29f53cdab338913a0793d3902334a926cea792c016acafc433633fa7c9d8151343445bd745bcb2b9a13cd375806a0bc08cc0b13c48e9774

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gauonzxd.2px.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a07c9c15-87af-4bdf-a0ca-857a319917fa.vbs

Filesize
719B

MD5
ca61eb71724a2abd6fd68c2fb1735275

SHA1
9ae1c76c4676866d1d6ff97fba81b1f742934baf

SHA256
8c8922d645103bd972ac94ac63f644c1f00fdcd0f4a745dde7372937573e30a9

SHA512
123c61a5cc9df98aa64738474b29ad02ee49737bffacfcd3802bdee00a5d01b58ed420309e20cd1895ce7ceb41aa5c41b9347d2cee616f3e7ba9509b3189d1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\c9e50182-e8c4-4bbd-91f4-2d8e22b00086.vbs

Filesize
718B

MD5
41d75071f55e0c51d52acb3841a21754

SHA1
c0e906f53adc301cd67b806a37da1430f613333d

SHA256
27e3efdf6630daf022ddf943f4d07531a5cd458ed12c46c08226da1ef1ce0778

SHA512
f6e6be8d53828c7c44475efa5088d1efe146ab9b72d72d78b8d7a4f3aa915520255f2872b94be5cee2a00b4c68e4cd59df96830c3ab514dfbb02d374b440f653

Download Submit
C:\Users\Admin\AppData\Local\Temp\e0e6cb3c-a5ea-413c-943f-2c4397b68853.vbs

Filesize
495B

MD5
914363e5ddf74cae57eda4a6b433cb48

SHA1
8d6411280b8a56f4c6a166f057bc47ef49fe97c2

SHA256
2d9c98d0b5522248e3894d131f0937ea1d91eaeb20bd54b180d7650014c74f27

SHA512
150280035a43573a3a495e51a3cd21f1d7871947c2e2b39c54598933fd9a96ee2e8f5feb43ab727de701149fc3534c1e8ff11cb19e04bc1a2f244009f9485193

Download Submit
C:\Users\Admin\AppData\Local\Temp\f6a96a9b-e3c7-41de-b977-ef50515326c1.vbs

Filesize
719B

MD5
e479efa7aab97e715b877685f445011b

SHA1
f28ed844f2e5afdd5cc9446ca49d5f7d935f2371

SHA256
c1851cb9b633e0e16dcfd43e6afca26a6406cbb3fe957499838f65a17de366d4

SHA512
910795cde0db4f1f7c8b43edb4119d3ad4baf879a142b0a7668eeda9f4d82fa9ec55e6f0c6dc605d158cd59e1b1566e5abb84277305a4b2f9bd26135e0c61f5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\f8b1528a-f4fa-4454-b330-43a36e0704b3.vbs

Filesize
719B

MD5
0d1dcab0c806b9128e7316a0aa2bfc96

SHA1
253b32b6be524cdc52b45a7353f0c299478da5ea

SHA256
ef50e38d513046bde1dd29cbac1521b35d1500e1d2099b14454e1cc3747554db

SHA512
495c5fe295091b5db250a9abe546ad0e641230ed87b694fc5868a59914725a23c0173599c73f3f5cb0037e72574949e94e379a3163669c6bd140481f6c405c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA098.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Windows\System32\sr-Latn-RS\dllhost.exe

Filesize
4.9MB

MD5
1942a319d1a63f4329b9a218916e7bb0

SHA1
67d8341f0b49c19debbfe1ad450464eca5c03eb5

SHA256
4db286d138eb7ff2207a20fcab04af2fffe73c4138d53aadb43c6cbb779ea742

SHA512
9fda304f1093a8bc94d52133076b1b4321f9d99afc98c26670c22355b337c373a7d22a8ddf967d0d503e0cb42fb5efb36f81506ea7279b5377ec274562ce30c7

Download Submit
memory/380-472-0x0000000002DA0000-0x0000000002DB2000-memory.dmp

Filesize
72KB

Download
memory/380-495-0x000000001CEB0000-0x000000001CFB2000-memory.dmp

Filesize
1.0MB

Download
memory/868-550-0x000000001C640000-0x000000001C742000-memory.dmp

Filesize
1.0MB

Download
memory/2664-216-0x000001D07D850000-0x000001D07D872000-memory.dmp

Filesize
136KB

Download
memory/2752-12-0x000000001CA60000-0x000000001CF88000-memory.dmp

Filesize
5.2MB

Download
memory/2752-11-0x000000001BD20000-0x000000001BD32000-memory.dmp

Filesize
72KB

Download
memory/2752-148-0x00007FFABFA63000-0x00007FFABFA65000-memory.dmp

Filesize
8KB

Download
memory/2752-18-0x000000001BF10000-0x000000001BF1C000-memory.dmp

Filesize
48KB

Download
memory/2752-17-0x000000001BDC0000-0x000000001BDC8000-memory.dmp

Filesize
32KB

Download
memory/2752-289-0x00007FFABFA60000-0x00007FFAC0521000-memory.dmp

Filesize
10.8MB

Download
memory/2752-310-0x00007FFABFA60000-0x00007FFAC0521000-memory.dmp

Filesize
10.8MB

Download
memory/2752-16-0x000000001BDB0000-0x000000001BDB8000-memory.dmp

Filesize
32KB

Download
memory/2752-13-0x000000001BD80000-0x000000001BD8A000-memory.dmp

Filesize
40KB

Download
memory/2752-15-0x000000001BDA0000-0x000000001BDAE000-memory.dmp

Filesize
56KB

Download
memory/2752-14-0x000000001BD90000-0x000000001BD9E000-memory.dmp

Filesize
56KB

Download
memory/2752-1-0x0000000000A80000-0x0000000000F74000-memory.dmp

Filesize
5.0MB

Download
memory/2752-0-0x00007FFABFA63000-0x00007FFABFA65000-memory.dmp

Filesize
8KB

Download
memory/2752-2-0x000000001BDE0000-0x000000001BF0E000-memory.dmp

Filesize
1.2MB

Download
memory/2752-10-0x000000001BD10000-0x000000001BD1A000-memory.dmp

Filesize
40KB

Download
memory/2752-8-0x000000001BCE0000-0x000000001BCF6000-memory.dmp

Filesize
88KB

Download
memory/2752-3-0x00007FFABFA60000-0x00007FFAC0521000-memory.dmp

Filesize
10.8MB

Download
memory/2752-9-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/2752-6-0x00000000031E0000-0x00000000031E8000-memory.dmp

Filesize
32KB

Download
memory/2752-7-0x00000000031F0000-0x0000000003200000-memory.dmp

Filesize
64KB

Download
memory/2752-5-0x000000001BD30000-0x000000001BD80000-memory.dmp

Filesize
320KB

Download
memory/2752-4-0x00000000031C0000-0x00000000031DC000-memory.dmp

Filesize
112KB

Download
memory/2968-515-0x000000001C670000-0x000000001C772000-memory.dmp

Filesize
1.0MB

Download
memory/3980-516-0x000000001BD40000-0x000000001BD52000-memory.dmp

Filesize
72KB

Download
memory/3980-533-0x000000001D230000-0x000000001D332000-memory.dmp

Filesize
1.0MB

Download
memory/4612-71-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4900-381-0x000000001CCE0000-0x000000001CDE2000-memory.dmp

Filesize
1.0MB

Download
memory/5056-334-0x000000001C8E0000-0x000000001C8F2000-memory.dmp

Filesize
72KB

Download