colibri | ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Size

4.9MB
MD5

364f9aa7879d48ffeb12ca794d1a1fb6
SHA1

7c5e4c6237881d714d43a95cfe69a4d15d8ff641
SHA256

ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7
SHA512

a6175b2facffdc57a98e77791cff47cf3b4ffba13e0ae433052bb70bdf94948a2724d0ba7e993094bb63f248dae9f78b8f615b7676299442b37aee61efc5492d
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8O:O

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3816	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	316	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	316	schtasks.exe	82

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3124-2-0x000000001B650000-0x000000001B77E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1660	powershell.exe
3588	powershell.exe
4944	powershell.exe
1664	powershell.exe
3528	powershell.exe
4432	powershell.exe
1228	powershell.exe
5052	powershell.exe
544	powershell.exe
2940	powershell.exe
1156	powershell.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 41 IoCs

pid	Process
5000	tmp9137.tmp.exe
2124	tmp9137.tmp.exe
3440	tmp9137.tmp.exe
3816	fontdrvhost.exe
1000	tmpDB0E.tmp.exe
2784	tmpDB0E.tmp.exe
2308	tmpDB0E.tmp.exe
876	fontdrvhost.exe
2188	tmp1EFD.tmp.exe
4212	tmp1EFD.tmp.exe
4156	fontdrvhost.exe
2400	tmp4F54.tmp.exe
3508	tmp4F54.tmp.exe
5072	tmp4F54.tmp.exe
1768	fontdrvhost.exe
1336	tmp6A7D.tmp.exe
3164	tmp6A7D.tmp.exe
4804	fontdrvhost.exe
5000	tmp9A18.tmp.exe
4064	tmp9A18.tmp.exe
876	fontdrvhost.exe
4368	tmpCA40.tmp.exe
3984	tmpCA40.tmp.exe
856	fontdrvhost.exe
3548	tmpFA97.tmp.exe
3032	tmpFA97.tmp.exe
3216	fontdrvhost.exe
1632	tmp2AA0.tmp.exe
2224	tmp2AA0.tmp.exe
3332	fontdrvhost.exe
4968	tmp5B26.tmp.exe
4392	tmp5B26.tmp.exe
1396	tmp5B26.tmp.exe
2528	tmp5B26.tmp.exe
2284	fontdrvhost.exe
4136	tmp77A7.tmp.exe
3628	tmp77A7.tmp.exe
3032	fontdrvhost.exe
4360	tmpA6F4.tmp.exe
4964	tmpA6F4.tmp.exe
1632	fontdrvhost.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 2124 set thread context of 3440	2124	tmp9137.tmp.exe	140
PID 2784 set thread context of 2308	2784	tmpDB0E.tmp.exe	178
PID 2188 set thread context of 4212	2188	tmp1EFD.tmp.exe	186
PID 3508 set thread context of 5072	3508	tmp4F54.tmp.exe	193
PID 1336 set thread context of 3164	1336	tmp6A7D.tmp.exe	199
PID 5000 set thread context of 4064	5000	tmp9A18.tmp.exe	205
PID 4368 set thread context of 3984	4368	tmpCA40.tmp.exe	211
PID 3548 set thread context of 3032	3548	tmpFA97.tmp.exe	217
PID 1632 set thread context of 2224	1632	tmp2AA0.tmp.exe	223
PID 1396 set thread context of 2528	1396	tmp5B26.tmp.exe	231
PID 4136 set thread context of 3628	4136	tmp77A7.tmp.exe	237
PID 4360 set thread context of 4964	4360	tmpA6F4.tmp.exe	243

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\unsecapp.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Windows Mail\dllhost.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\29c1c3cc0f7685	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\RCX99E5.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Windows Mail\dllhost.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCXA749.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\MSBuild\RCXA9BB.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Java\jdk-1.8\ee2ad38f3d4382	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\Registry.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Windows Mail\RCXA022.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Java\jdk-1.8\Registry.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Windows Portable Devices\6ccacd8608530f	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\unsecapp.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\MSBuild\SearchApp.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Windows Mail\5940a34987c991	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\Windows Portable Devices\Idle.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\MSBuild\SearchApp.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Program Files\MSBuild\38384e6a620884	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Windows Portable Devices\Idle.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\RCXB558.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\RuntimeBroker.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\de-DE\Registry.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\it-IT\StartMenuExperienceHost.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\PrintDialog\Assets\wininit.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\it-IT\RCX933B.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\PolicyDefinitions\RCX9BFA.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\it-IT\System.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\Migration\WTR\9e8d7a4ca61bd9	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\it-IT\StartMenuExperienceHost.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\PolicyDefinitions\886983d96e3d3e	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\it-IT\27d1bcfc3c54e0	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\de-DE\ee2ad38f3d4382	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\de-DE\RCXB2D6.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\de-DE\Registry.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\it-IT\55b276f4edf653	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\PolicyDefinitions\csrss.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\it-IT\System.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\Migration\WTR\RuntimeBroker.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\it-IT\RCXB055.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\PrintDialog\Assets\wininit.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File created	C:\Windows\PrintDialog\Assets\56085415360792	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\Migration\WTR\RCX90F7.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\PolicyDefinitions\csrss.exe	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
File opened for modification	C:\Windows\PrintDialog\Assets\RCXA4B8.tmp	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6A7D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCA40.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpFA97.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4F54.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9A18.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5B26.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp77A7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9137.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1EFD.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4F54.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5B26.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5B26.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA6F4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9137.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDB0E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDB0E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2AA0.tmp.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3580	schtasks.exe
4824	schtasks.exe
3292	schtasks.exe
2784	schtasks.exe
2308	schtasks.exe
888	schtasks.exe
3928	schtasks.exe
3320	schtasks.exe
1652	schtasks.exe
2180	schtasks.exe
3328	schtasks.exe
3816	schtasks.exe
1720	schtasks.exe
4056	schtasks.exe
4768	schtasks.exe
1764	schtasks.exe
3436	schtasks.exe
2464	schtasks.exe
2320	schtasks.exe
2256	schtasks.exe
5108	schtasks.exe
2280	schtasks.exe
1800	schtasks.exe
3628	schtasks.exe
1436	schtasks.exe
3836	schtasks.exe
2144	schtasks.exe
1080	schtasks.exe
2060	schtasks.exe
1220	schtasks.exe
1000	schtasks.exe
2708	schtasks.exe
5052	schtasks.exe
3528	schtasks.exe
4832	schtasks.exe
5072	schtasks.exe
3760	schtasks.exe
4800	schtasks.exe
1156	schtasks.exe
3588	schtasks.exe
3780	schtasks.exe
3296	schtasks.exe
1980	schtasks.exe
4908	schtasks.exe
3484	schtasks.exe
2864	schtasks.exe
2740	schtasks.exe
3660	schtasks.exe
1244	schtasks.exe
924	schtasks.exe
1700	schtasks.exe
1376	schtasks.exe
4220	schtasks.exe
3164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
1156	powershell.exe
1156	powershell.exe
4944	powershell.exe
4944	powershell.exe
1660	powershell.exe
1660	powershell.exe
5052	powershell.exe
5052	powershell.exe
3528	powershell.exe
3528	powershell.exe
1228	powershell.exe
1228	powershell.exe
1664	powershell.exe
1664	powershell.exe
3588	powershell.exe
3588	powershell.exe
544	powershell.exe
544	powershell.exe
4432	powershell.exe
4432	powershell.exe
2940	powershell.exe
2940	powershell.exe
1156	powershell.exe
1228	powershell.exe
3588	powershell.exe
4944	powershell.exe
1660	powershell.exe
5052	powershell.exe
4432	powershell.exe
1664	powershell.exe
3528	powershell.exe
544	powershell.exe
2940	powershell.exe
3816	fontdrvhost.exe
876	fontdrvhost.exe
4156	fontdrvhost.exe
1768	fontdrvhost.exe
4804	fontdrvhost.exe
876	fontdrvhost.exe
856	fontdrvhost.exe
3216	fontdrvhost.exe
3332	fontdrvhost.exe
2284	fontdrvhost.exe
3032	fontdrvhost.exe
1632	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	3816	fontdrvhost.exe
Token: SeDebugPrivilege	876	fontdrvhost.exe
Token: SeDebugPrivilege	4156	fontdrvhost.exe
Token: SeDebugPrivilege	1768	fontdrvhost.exe
Token: SeDebugPrivilege	4804	fontdrvhost.exe
Token: SeDebugPrivilege	876	fontdrvhost.exe
Token: SeDebugPrivilege	856	fontdrvhost.exe
Token: SeDebugPrivilege	3216	fontdrvhost.exe
Token: SeDebugPrivilege	3332	fontdrvhost.exe
Token: SeDebugPrivilege	2284	fontdrvhost.exe
Token: SeDebugPrivilege	3032	fontdrvhost.exe
Token: SeDebugPrivilege	1632	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 5000	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	137
PID 3124 wrote to memory of 5000	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	137
PID 3124 wrote to memory of 5000	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	137
PID 5000 wrote to memory of 2124	5000	tmp9137.tmp.exe	139
PID 5000 wrote to memory of 2124	5000	tmp9137.tmp.exe	139
PID 5000 wrote to memory of 2124	5000	tmp9137.tmp.exe	139
PID 2124 wrote to memory of 3440	2124	tmp9137.tmp.exe	140
PID 2124 wrote to memory of 3440	2124	tmp9137.tmp.exe	140
PID 2124 wrote to memory of 3440	2124	tmp9137.tmp.exe	140
PID 2124 wrote to memory of 3440	2124	tmp9137.tmp.exe	140
PID 2124 wrote to memory of 3440	2124	tmp9137.tmp.exe	140
PID 2124 wrote to memory of 3440	2124	tmp9137.tmp.exe	140
PID 2124 wrote to memory of 3440	2124	tmp9137.tmp.exe	140
PID 3124 wrote to memory of 2940	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	147
PID 3124 wrote to memory of 2940	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	147
PID 3124 wrote to memory of 4944	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	148
PID 3124 wrote to memory of 4944	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	148
PID 3124 wrote to memory of 1156	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	149
PID 3124 wrote to memory of 1156	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	149
PID 3124 wrote to memory of 1664	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	150
PID 3124 wrote to memory of 1664	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	150
PID 3124 wrote to memory of 3528	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	151
PID 3124 wrote to memory of 3528	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	151
PID 3124 wrote to memory of 1660	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	152
PID 3124 wrote to memory of 1660	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	152
PID 3124 wrote to memory of 4432	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	153
PID 3124 wrote to memory of 4432	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	153
PID 3124 wrote to memory of 3588	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	154
PID 3124 wrote to memory of 3588	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	154
PID 3124 wrote to memory of 1228	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	155
PID 3124 wrote to memory of 1228	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	155
PID 3124 wrote to memory of 5052	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	156
PID 3124 wrote to memory of 5052	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	156
PID 3124 wrote to memory of 544	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	157
PID 3124 wrote to memory of 544	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	157
PID 3124 wrote to memory of 4996	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	168
PID 3124 wrote to memory of 4996	3124	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe	168
PID 4996 wrote to memory of 4384	4996	cmd.exe	171
PID 4996 wrote to memory of 4384	4996	cmd.exe	171
PID 4996 wrote to memory of 3816	4996	cmd.exe	172
PID 4996 wrote to memory of 3816	4996	cmd.exe	172
PID 3816 wrote to memory of 3240	3816	fontdrvhost.exe	173
PID 3816 wrote to memory of 3240	3816	fontdrvhost.exe	173
PID 3816 wrote to memory of 3956	3816	fontdrvhost.exe	174
PID 3816 wrote to memory of 3956	3816	fontdrvhost.exe	174
PID 3816 wrote to memory of 1000	3816	fontdrvhost.exe	175
PID 3816 wrote to memory of 1000	3816	fontdrvhost.exe	175
PID 3816 wrote to memory of 1000	3816	fontdrvhost.exe	175
PID 1000 wrote to memory of 2784	1000	tmpDB0E.tmp.exe	177
PID 1000 wrote to memory of 2784	1000	tmpDB0E.tmp.exe	177
PID 1000 wrote to memory of 2784	1000	tmpDB0E.tmp.exe	177
PID 2784 wrote to memory of 2308	2784	tmpDB0E.tmp.exe	178
PID 2784 wrote to memory of 2308	2784	tmpDB0E.tmp.exe	178
PID 2784 wrote to memory of 2308	2784	tmpDB0E.tmp.exe	178
PID 2784 wrote to memory of 2308	2784	tmpDB0E.tmp.exe	178
PID 2784 wrote to memory of 2308	2784	tmpDB0E.tmp.exe	178
PID 2784 wrote to memory of 2308	2784	tmpDB0E.tmp.exe	178
PID 2784 wrote to memory of 2308	2784	tmpDB0E.tmp.exe	178
PID 3240 wrote to memory of 876	3240	WScript.exe	180
PID 3240 wrote to memory of 876	3240	WScript.exe	180
PID 876 wrote to memory of 2436	876	fontdrvhost.exe	182
PID 876 wrote to memory of 2436	876	fontdrvhost.exe	182
PID 876 wrote to memory of 2660	876	fontdrvhost.exe	183
PID 876 wrote to memory of 2660	876	fontdrvhost.exe	183

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe
"C:\Users\Admin\AppData\Local\Temp\ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3124
- C:\Users\Admin\AppData\Local\Temp\tmp9137.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9137.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Users\Admin\AppData\Local\Temp\tmp9137.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp9137.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\tmp9137.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp9137.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\C7vDpQnmRb.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4384
- - C:\Users\Default\Application Data\fontdrvhost.exe
    "C:\Users\Default\Application Data\fontdrvhost.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3816
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15f422cc-3c92-4b44-a093-5f2d87cbd2c4.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3240
    - - C:\Users\Default\Application Data\fontdrvhost.exe
        
        "C:\Users\Default\Application Data\fontdrvhost.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:876
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5bc1a784-0b1a-4af3-b167-0a5730e9090b.vbs"
        6⤵
        
        PID:2436
        
        C:\Users\Default\Application Data\fontdrvhost.exe
        
        "C:\Users\Default\Application Data\fontdrvhost.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cde10654-c172-4dfe-96ba-5c343e372c03.vbs"
        8⤵
        
        PID:552
        
        C:\Users\Default\Application Data\fontdrvhost.exe
        
        "C:\Users\Default\Application Data\fontdrvhost.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b06142b-1629-4b66-8a1d-77a4f5074e2b.vbs"
        10⤵
        
        PID:2784
        
        C:\Users\Default\Application Data\fontdrvhost.exe
        
        "C:\Users\Default\Application Data\fontdrvhost.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6661203a-0504-464b-a39a-d60a0b405144.vbs"
        12⤵
        
        PID:4780
        
        C:\Users\Default\Application Data\fontdrvhost.exe
        
        "C:\Users\Default\Application Data\fontdrvhost.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a58bf6d1-bd06-42ba-836f-e5c171cc42b3.vbs"
        14⤵
        
        PID:1452
        
        C:\Users\Default\Application Data\fontdrvhost.exe
        
        "C:\Users\Default\Application Data\fontdrvhost.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\530e6911-dc3e-47b8-8fd5-89d27302b0a4.vbs"
        16⤵
        
        PID:3368
        
        C:\Users\Default\Application Data\fontdrvhost.exe
        
        "C:\Users\Default\Application Data\fontdrvhost.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1bc9312-ab2a-449b-8b55-6009c9c88d4b.vbs"
        18⤵
        
        PID:2056
        
        C:\Users\Default\Application Data\fontdrvhost.exe
        
        "C:\Users\Default\Application Data\fontdrvhost.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c960f4b-6f61-4b87-b97e-89bf912a60d9.vbs"
        20⤵
        
        PID:3292
        
        C:\Users\Default\Application Data\fontdrvhost.exe
        
        "C:\Users\Default\Application Data\fontdrvhost.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f021b76-8811-4550-bc59-ef7588e9a369.vbs"
        22⤵
        
        PID:116
        
        C:\Users\Default\Application Data\fontdrvhost.exe
        
        "C:\Users\Default\Application Data\fontdrvhost.exe"
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35cf54b5-21c3-404f-808d-a4d40da97c95.vbs"
        24⤵
        
        PID:888
        
        C:\Users\Default\Application Data\fontdrvhost.exe
        
        "C:\Users\Default\Application Data\fontdrvhost.exe"
        25⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\837b52ea-2a3a-413f-afd0-2906012eb3ac.vbs"
        24⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\tmpA6F4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA6F4.tmp.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\tmpA6F4.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA6F4.tmp.exe"
        25⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b63f6e6f-9453-45bc-b898-572c4fcc5142.vbs"
        22⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\tmp77A7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp77A7.tmp.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\tmp77A7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp77A7.tmp.exe"
        23⤵
        Executes dropped EXE
        
        PID:3628
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\403d4101-32f0-4f5e-8d50-90c2b77d3d0f.vbs"
        20⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\tmp5B26.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5B26.tmp.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\tmp5B26.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5B26.tmp.exe"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\tmp5B26.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5B26.tmp.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\tmp5B26.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5B26.tmp.exe"
        23⤵
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e774fa84-a5bd-4789-888a-fd2e048a6044.vbs"
        18⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\tmp2AA0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2AA0.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\tmp2AA0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2AA0.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a41b2cb9-d680-4ad0-a5bc-b62b15733eac.vbs"
        16⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\tmpFA97.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFA97.tmp.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\tmpFA97.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpFA97.tmp.exe"
        17⤵
        Executes dropped EXE
        
        PID:3032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43186fcd-88a8-4ea0-95cb-cb9d68a69efc.vbs"
        14⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\tmpCA40.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCA40.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\tmpCA40.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCA40.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:3984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\378dc238-566a-4795-a812-6c2ec027b5d4.vbs"
        12⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\tmp9A18.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9A18.tmp.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\tmp9A18.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9A18.tmp.exe"
        13⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3ae6964-acd2-4e47-862b-d9d41c11591b.vbs"
        10⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\tmp6A7D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6A7D.tmp.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\tmp6A7D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6A7D.tmp.exe"
        11⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf634a62-775b-4aed-b20b-57c23eed9725.vbs"
        8⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\tmp4F54.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4F54.tmp.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\tmp4F54.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4F54.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\tmp4F54.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4F54.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:5072
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84a2f404-6cad-4fbb-aebc-b485336e913c.vbs"
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\tmp1EFD.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1EFD.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\tmp1EFD.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1EFD.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:4212
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\042011e5-4858-4d12-9ec1-d95b9bd203e6.vbs"
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\tmpDB0E.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpDB0E.tmp.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\tmpDB0E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDB0E.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\tmpDB0E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDB0E.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Contacts\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Admin\Contacts\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Contacts\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Migration\WTR\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\it-IT\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\it-IT\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\it-IT\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Application Data\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Application Data\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Application Data\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Users\Public\AccountPictures\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\AccountPictures\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jdk-1.8\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk-1.8\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\PolicyDefinitions\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\PolicyDefinitions\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Windows\PrintDialog\Assets\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\PrintDialog\Assets\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\PrintDialog\Assets\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\MSBuild\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\it-IT\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\it-IT\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\it-IT\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Windows\de-DE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\de-DE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\042011e5-4858-4d12-9ec1-d95b9bd203e6.vbs

Filesize
501B

MD5
10c2b1ad08a7e585e76ec5e8fb719ee1

SHA1
7078d486d28b74814d66a43ddb65802d5b598ac3

SHA256
4df8b83a7fe51167c651ed5b3b1909a055aa6f7a77283b3f6d78421e9e6d6bcb

SHA512
14e05075b6f2898139fc4121cb45709b40533918663b5f5a42a9cee553b6372a33adba75b527cc2069aefabbc9236e9ed074e20ed0856d59ebc2940b18c9e6a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\15f422cc-3c92-4b44-a093-5f2d87cbd2c4.vbs

Filesize
725B

MD5
1847d95e185228a699f4b79b697b985c

SHA1
8a0616f54870e021af990b62d8a6fd8a6966474f

SHA256
2cd6fd23110ee0bd1cb36001a4548c4bd6741ef420280ecbbb367867ad3226c7

SHA512
542794b4686182446af5857b331b33019d5b4e466dba70361a8e43e0ee167651ad3431423a10c585599ae37e2d473a27f664868a5324d7c48dfc23e1033a33e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2b06142b-1629-4b66-8a1d-77a4f5074e2b.vbs

Filesize
725B

MD5
a89236e6231b6a75c769b98a92d370c9

SHA1
e36e7eca31696cdf75c9b0f37adc1ba4bb63ee98

SHA256
36b97c0334a974c714365a23aca065b0a889f12d291e9c55df1f9c909faa8264

SHA512
39e7e307eee65b2de0e414c9cbad731bec126337d1c4a0f7934f62b9cc86347a8e58928943c6273230554a580cf574e6669c63c52be6825525e5fce50f724b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\32d9027b54454515da220baed833c502063b714c.exe

Filesize
4.9MB

MD5
3a8e1cd013430b18cc32a439b8567650

SHA1
add5a3cc929be3298ffaa47dc3d12d22dc1596b5

SHA256
f0bc9695a169d190df217fa8227ef55c548e0e707c96aa70bd1b2531bf9605e0

SHA512
798a81dd15ea70027d46ac535cdbe1662ec3821e1499daa2c8e6ec7b3b433b0ca357329586e25570940b5ad72b2de09d23dcfa13907b28dbf4646fbb33e34c4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\530e6911-dc3e-47b8-8fd5-89d27302b0a4.vbs

Filesize
724B

MD5
7cff512975b7877ce43635601a620c7b

SHA1
f7431b0a79e25e1dfdeca0813eec38aa1d6b6533

SHA256
d09ab42663d846fcc26df93034669e1a67809a45078cbd57ef789fbdd9b40722

SHA512
d767d9d2897aee33a58e8f6e5f0b36834cf15926d79ea61c1f2592cbf1d5084ea4033837cd23aa87f2aa3195e1759fac7309eb9fe53934ebf4050bfce6332d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\5bc1a784-0b1a-4af3-b167-0a5730e9090b.vbs

Filesize
724B

MD5
7adbc93341795237785bf941c526bf6d

SHA1
e895757565f457c9911f335aafb7f4c1b68a6f01

SHA256
01b2a0ede0b364e160c2ed42ede0bf36474af2b5925809669e6f157fe24a35fa

SHA512
f3912f534b9bc41a328495686aaa30c71de4ffc6021932347a824f410e8ff93cc57e04bde1a50055ddd9d21ab4fdc6c4a1165a028d2b6eb9ecd16323998e4676

Download Submit
C:\Users\Admin\AppData\Local\Temp\6661203a-0504-464b-a39a-d60a0b405144.vbs

Filesize
725B

MD5
9362d95c8b165661056516b8ba31324c

SHA1
621dc43ff6d744d49b4d9a757dc91419a89db032

SHA256
bf539def9c3ad57e117646258160daad12c382bd01102f73699efbe4d600fd5a

SHA512
b8a1a2c0b606504015515819bc9666a44c61fd61f4af46b1d49e63c02d2d7157a421a492a31f9ad14ee55dc546b99933628cb088c9cf8785fab4a890799e5444

Download Submit
C:\Users\Admin\AppData\Local\Temp\C7vDpQnmRb.bat

Filesize
214B

MD5
5955aaa2d107f537a20edd14e08af7cb

SHA1
dad66483e960b0526ff834ad43338c9b6a98bc42

SHA256
c3bbcaa050370669aa65c60856d86b97d12102fa6aadbf1bcf29eed53ffa876e

SHA512
f410a065259574c296ba37891d99874cfe44a5bdf455043d5628dffd6e478766e1952918e86d26e41f4ab9437ca3e9a181de760f221565dfa55ca7b32606f5d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nvcdog3x.j2w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cde10654-c172-4dfe-96ba-5c343e372c03.vbs

Filesize
725B

MD5
6319471f33c5738dfa76baed7ededc99

SHA1
b03300123d5d40c99030717b64c7582404b14eaa

SHA256
9e7857ed6d5f730776da0957bb5a9d0f283409a4f19c86205588d0d576fa972c

SHA512
3e1cc6b7ecf90ab8a862e9c19eb435c9a23b86379ca6c22de32f8cc5b14d571b56d2bc4e294fbf1544ddd73831a3381f51f92b29b6f2796ae5af20ac2b26c8b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9137.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Default\AppData\Roaming\fontdrvhost.exe

Filesize
4.9MB

MD5
8f9225a329ab197e0de5853d40defa3a

SHA1
8228ea4f5d25e1162e39ba36db73eedcf251b3e3

SHA256
724a5ec4b101d5756b8208ffb326a3edb3694dad62c7f61b032ec07faa186dcb

SHA512
b84e7c5f04a0964b5befc670009edccdc1d8640bf6bc3390deae918e3641e0a7c868444be6cacc9e232dc6f3fa22eee3caf2cf11f85b245e9a9ed8b833cc4f76

Download Submit
C:\Users\Public\AccountPictures\SearchApp.exe

Filesize
4.9MB

MD5
364f9aa7879d48ffeb12ca794d1a1fb6

SHA1
7c5e4c6237881d714d43a95cfe69a4d15d8ff641

SHA256
ef4bdcb7a4565b7a4879d30ba9ed8c0466f82ca8695dcb7942479e2105b562d7

SHA512
a6175b2facffdc57a98e77791cff47cf3b4ffba13e0ae433052bb70bdf94948a2724d0ba7e993094bb63f248dae9f78b8f615b7676299442b37aee61efc5492d

Download Submit
C:\Windows\PrintDialog\Assets\wininit.exe

Filesize
4.9MB

MD5
0a66a1944f238979940e0dba34434555

SHA1
cf7d9f38b9f5fc1b21a9b04cacab18b05d5432f7

SHA256
413b64b818ca6ab34bd32588508d6e05f14114f530e907bcd97c8bd581c115f2

SHA512
d63343bc139ca3167775a7ac96be651d7ffbb202490279386e16265a42eee02b1efcca8a1d668f412ca298d8510e3efe38f20f0946651ee8925a2fca8095baff

Download Submit
memory/876-349-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/1660-217-0x000001AE8FD80000-0x000001AE8FDA2000-memory.dmp

Filesize
136KB

Download
memory/3124-12-0x000000001C200000-0x000000001C728000-memory.dmp

Filesize
5.2MB

Download
memory/3124-0-0x00007FFC7EB33000-0x00007FFC7EB35000-memory.dmp

Filesize
8KB

Download
memory/3124-162-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/3124-152-0x00007FFC7EB33000-0x00007FFC7EB35000-memory.dmp

Filesize
8KB

Download
memory/3124-1-0x0000000000240000-0x0000000000734000-memory.dmp

Filesize
5.0MB

Download
memory/3124-18-0x000000001BCE0000-0x000000001BCEC000-memory.dmp

Filesize
48KB

Download
memory/3124-17-0x000000001BCD0000-0x000000001BCD8000-memory.dmp

Filesize
32KB

Download
memory/3124-16-0x000000001B630000-0x000000001B638000-memory.dmp

Filesize
32KB

Download
memory/3124-15-0x0000000002A40000-0x0000000002A4E000-memory.dmp

Filesize
56KB

Download
memory/3124-13-0x0000000002A20000-0x0000000002A2A000-memory.dmp

Filesize
40KB

Download
memory/3124-14-0x0000000002A30000-0x0000000002A3E000-memory.dmp

Filesize
56KB

Download
memory/3124-193-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/3124-11-0x0000000002A10000-0x0000000002A22000-memory.dmp

Filesize
72KB

Download
memory/3124-2-0x000000001B650000-0x000000001B77E000-memory.dmp

Filesize
1.2MB

Download
memory/3124-10-0x00000000029F0000-0x00000000029FA000-memory.dmp

Filesize
40KB

Download
memory/3124-9-0x00000000029E0000-0x00000000029F0000-memory.dmp

Filesize
64KB

Download
memory/3124-8-0x00000000029C0000-0x00000000029D6000-memory.dmp

Filesize
88KB

Download
memory/3124-6-0x00000000010B0000-0x00000000010B8000-memory.dmp

Filesize
32KB

Download
memory/3124-7-0x00000000029B0000-0x00000000029C0000-memory.dmp

Filesize
64KB

Download
memory/3124-5-0x000000001BC80000-0x000000001BCD0000-memory.dmp

Filesize
320KB

Download
memory/3124-4-0x0000000001090000-0x00000000010AC000-memory.dmp

Filesize
112KB

Download
memory/3124-3-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/3440-84-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3816-321-0x0000000000E30000-0x0000000001324000-memory.dmp

Filesize
5.0MB

Download