dcrat | 01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2024 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Size

1.8MB
MD5

f3d2bbf94502d252041c35316a3437be
SHA1

337394ddba850c7e6c937087f93d1fa2dfcad0a2
SHA256

01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83
SHA512

e56b5f191ade12a301d249e17c3d933fcf11e18a591734b503ee8d106480d2bed92af277aded9c1e4b09b6665fdd1c3bf8069329949a24645b8bc229a8caca3e
SSDEEP

49152:5WqKKPZ1snfJ+rqDPuQDLME5MT4rDQNpfh5:jKKZ1sRD2Q3N5MT4rO

Score

10^/10

dcrat discovery evasion execution infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3412	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	1772	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	1772	schtasks.exe	83

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1540-1-0x0000000000060000-0x000000000022C000-memory.dmp	dcrat
behavioral2/files/0x000a000000023ba8-32.dat	dcrat
behavioral2/files/0x000f000000023bcb-103.dat	dcrat
behavioral2/files/0x000d000000023ba3-126.dat	dcrat
behavioral2/files/0x000c000000023bac-137.dat	dcrat
behavioral2/files/0x000500000001e75d-148.dat	dcrat
behavioral2/files/0x000e000000023bcd-160.dat	dcrat
behavioral2/files/0x000c000000023bb7-171.dat	dcrat
behavioral2/files/0x000b000000023bbe-205.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe
4140	powershell.exe
4488	powershell.exe
4120	powershell.exe
2124	powershell.exe
3536	powershell.exe
1280	powershell.exe
2136	powershell.exe
2060	powershell.exe
464	powershell.exe
1136	powershell.exe
2068	powershell.exe
1276	powershell.exe
4704	powershell.exe
1716	powershell.exe
1016	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 1 IoCs

pid	Process
5580	RuntimeBroker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\886983d96e3d3e	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\MSBuild\RCXAC6A.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\MSBuild\winlogon.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXAE8E.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Windows Mail\RCXB18E.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Mozilla Firefox\unsecapp.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Idle.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6ccacd8608530f	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXA0A7.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Windows Mail\RuntimeBroker.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\MSBuild\cc11b995f2a76d	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files\Windows Mail\9e8d7a4ca61bd9	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXAF0C.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RCXB644.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXBD6F.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXA0C7.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Google\Update\RCXB421.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Google\Update\csrss.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RCXB6B3.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\Idle.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\MSBuild\winlogon.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Windows Mail\RCXB120.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Google\Update\RCXB3B2.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXBDDD.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXC1E8.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\9e8d7a4ca61bd9	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files\Mozilla Firefox\unsecapp.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\MSBuild\RCXABEC.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files\Mozilla Firefox\29c1c3cc0f7685	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Windows Portable Devices\e6c9b481da804f	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\taskhostw.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXC1E7.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Google\Update\csrss.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files\Windows Mail\RuntimeBroker.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files\Windows Multimedia Platform\taskhostw.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Program Files\Windows Multimedia Platform\ea9f0e6c9e2dcd	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Globalization\unsecapp.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File created	C:\Windows\Globalization\29c1c3cc0f7685	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Windows\Globalization\RCXA754.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Windows\Globalization\RCXA7C2.tmp	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
File opened for modification	C:\Windows\Globalization\unsecapp.exe	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4864	schtasks.exe
4216	schtasks.exe
692	schtasks.exe
4884	schtasks.exe
5036	schtasks.exe
3252	schtasks.exe
2484	schtasks.exe
4684	schtasks.exe
5032	schtasks.exe
4740	schtasks.exe
4220	schtasks.exe
1276	schtasks.exe
380	schtasks.exe
2060	schtasks.exe
4992	schtasks.exe
4760	schtasks.exe
3388	schtasks.exe
3744	schtasks.exe
4144	schtasks.exe
588	schtasks.exe
2672	schtasks.exe
3804	schtasks.exe
2568	schtasks.exe
3372	schtasks.exe
404	schtasks.exe
5060	schtasks.exe
2448	schtasks.exe
4336	schtasks.exe
3464	schtasks.exe
552	schtasks.exe
2700	schtasks.exe
4524	schtasks.exe
3300	schtasks.exe
5076	schtasks.exe
2124	schtasks.exe
3340	schtasks.exe
2552	schtasks.exe
2612	schtasks.exe
3620	schtasks.exe
1464	schtasks.exe
2260	schtasks.exe
3412	schtasks.exe
5068	schtasks.exe
2720	schtasks.exe
4808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
2124	powershell.exe
2124	powershell.exe
3536	powershell.exe
3536	powershell.exe
2060	powershell.exe
2060	powershell.exe
4120	powershell.exe
4120	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	5580	RuntimeBroker.exe
Token: SeBackupPrivilege	6136	vssvc.exe
Token: SeRestorePrivilege	6136	vssvc.exe
Token: SeAuditPrivilege	6136	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1276	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	135
PID 1540 wrote to memory of 1276	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	135
PID 1540 wrote to memory of 464	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	136
PID 1540 wrote to memory of 464	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	136
PID 1540 wrote to memory of 2124	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	137
PID 1540 wrote to memory of 2124	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	137
PID 1540 wrote to memory of 2928	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	138
PID 1540 wrote to memory of 2928	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	138
PID 1540 wrote to memory of 4140	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	139
PID 1540 wrote to memory of 4140	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	139
PID 1540 wrote to memory of 3536	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	140
PID 1540 wrote to memory of 3536	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	140
PID 1540 wrote to memory of 1136	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	141
PID 1540 wrote to memory of 1136	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	141
PID 1540 wrote to memory of 4704	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	142
PID 1540 wrote to memory of 4704	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	142
PID 1540 wrote to memory of 1280	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	143
PID 1540 wrote to memory of 1280	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	143
PID 1540 wrote to memory of 2068	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	144
PID 1540 wrote to memory of 2068	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	144
PID 1540 wrote to memory of 1716	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	145
PID 1540 wrote to memory of 1716	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	145
PID 1540 wrote to memory of 2136	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	146
PID 1540 wrote to memory of 2136	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	146
PID 1540 wrote to memory of 1016	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	147
PID 1540 wrote to memory of 1016	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	147
PID 1540 wrote to memory of 2060	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	148
PID 1540 wrote to memory of 2060	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	148
PID 1540 wrote to memory of 4488	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	149
PID 1540 wrote to memory of 4488	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	149
PID 1540 wrote to memory of 4120	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	150
PID 1540 wrote to memory of 4120	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	150
PID 1540 wrote to memory of 4744	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	166
PID 1540 wrote to memory of 4744	1540	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe	166
PID 4744 wrote to memory of 4544	4744	cmd.exe	169
PID 4744 wrote to memory of 4544	4744	cmd.exe	169
PID 4744 wrote to memory of 5580	4744	cmd.exe	177
PID 4744 wrote to memory of 5580	4744	cmd.exe	177
PID 5580 wrote to memory of 5804	5580	RuntimeBroker.exe	179
PID 5580 wrote to memory of 5804	5580	RuntimeBroker.exe	179
PID 5580 wrote to memory of 5856	5580	RuntimeBroker.exe	180
PID 5580 wrote to memory of 5856	5580	RuntimeBroker.exe	180
PID 5580 wrote to memory of 4488	5580	RuntimeBroker.exe	189
PID 5580 wrote to memory of 4488	5580	RuntimeBroker.exe	189
PID 4488 wrote to memory of 1196	4488	msedge.exe	190
PID 4488 wrote to memory of 1196	4488	msedge.exe	190
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191
PID 4488 wrote to memory of 5240	4488	msedge.exe	191

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe
"C:\Users\Admin\AppData\Local\Temp\01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Globalization\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Videos\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XTPArJRuio.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4544
- - C:\Recovery\WindowsRE\RuntimeBroker.exe
    "C:\Recovery\WindowsRE\RuntimeBroker.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5580
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c754b54-8525-4cc7-b31d-8f4bb8a7aead.vbs"
      4⤵
      PID:5804
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c42c9c5b-7736-4dbf-9342-b2d5758916fc.vbs"
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:12209/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd307e46f8,0x7ffd307e4708,0x7ffd307e4718
        5⤵
        
        PID:1196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        5⤵
        
        PID:5240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
        5⤵
        
        PID:1716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
        5⤵
        
        PID:4816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
        5⤵
        
        PID:3620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
        5⤵
        
        PID:5564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
        5⤵
        
        PID:4088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
        5⤵
        
        PID:5748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
        5⤵
        
        PID:400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
        5⤵
        
        PID:540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
        5⤵
        
        PID:3112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
        5⤵
        
        PID:1540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
        5⤵
        
        PID:872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14295023686086137048,8001982229344567385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:1
        5⤵
        
        PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Windows\Globalization\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Globalization\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Windows\Globalization\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Videos\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Videos\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Videos\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1792

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\csrss.exe

Filesize
1.8MB

MD5
5ccdbdadb901c14b415fdc78000251e9

SHA1
ec9ab15dc2b1bd13ca5922f80b1a1cdff21141bf

SHA256
cb9008d5dbc595e50a1d97ad7b03c8c56691764075b648f1a86effaa083c13ad

SHA512
797e81172c23a7a2120cfa255d7767d3e5a1c4bfcef6f21611875583e1baad4194cbbf2dba4f49726688243a1538daf0714556857a2f3dd9541cb6bc058bfdbb

Download Submit
C:\Program Files (x86)\MSBuild\winlogon.exe

Filesize
1.8MB

MD5
fb2b648119d25522248a822316728a22

SHA1
eedd55b8fa1cd52d3a0281979451de46e2004a1e

SHA256
a90e0da12f667dac7b6fe7df778110b6d932eb3c5a937cef68356c5d18daa027

SHA512
73bb0191fce807ccbfd9679dddc2d6ad26c754b83ad93a3e5c62636fc3bf659a6e8536340b2b26536fd5f99b5bea463fad3b05d5713e35c49e1b8fcffc41c2ef

Download Submit
C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe

Filesize
1.8MB

MD5
58cbcc04c5faffe6ffa694198abe2f5c

SHA1
96f2b03329575ec286e1e0b6400f9fd5ad1ebde6

SHA256
c3e3f1462688b90153e7df23cd0d710c871e865473887b4df8aef025583b0e1e

SHA512
c4e9cbb8f535e705832b1b2065ffd64d4c3340bf932ae1f91c1ce1f8b536465f33825551b9ead8f5236f2557b1452498d364865e3fbb36eb6150388420b00b8d

Download Submit
C:\Program Files\Mozilla Firefox\unsecapp.exe

Filesize
1.8MB

MD5
838923ceed3c9e974778e5383ed0c3eb

SHA1
9de39eba8b7a42e1be9194af9dbb20571224c8b6

SHA256
3574e41287c440440b053ba74859c86983acf767deada9267bc6fe9edc7af23b

SHA512
2d33a5fec5a6eb1afcefaf0f14efe74774256a269cc2342ad69a4851c79f3b592a98839cac682f9fafc55b076f9eae7f2ef8d985f9978cbd66a01386025be226

Download Submit
C:\Program Files\Windows Mail\RuntimeBroker.exe

Filesize
1.8MB

MD5
60a48d100b1ae7e5e4bb074bacb1f8a9

SHA1
7631f9ebbe2d709e20ae490e3f8e392db5ba8d49

SHA256
1d554173697932df1b12cbe10044d21106b1563ef5e66d17cd66f5cd229e4677

SHA512
2405415f919d965eccea22593478d55ff8b404a26547b2c6fe5d2d2804fb14ff7905e074f1e75719c126a78339208d1efcf97b02bc370b042e686f2453c734ce

Download Submit
C:\Program Files\Windows Multimedia Platform\taskhostw.exe

Filesize
1.8MB

MD5
bcd490c8988a310ce2bd8492e5d59a67

SHA1
199515507c025714c60be7f694605989d6bc067a

SHA256
ee3109aef6f8bb7729b25388ec80ac31546f887ad8e95255b246011ea7c4c5ab

SHA512
d447010048eb3bb115f4da9cedd07eeb07a9bf6b05cd2c4d723fcaf31f88905e4f75c0348cf7e710ecf2e35f296c015429b23c7cbdd366217a8e08d0df6bbcc2

Download Submit
C:\Recovery\WindowsRE\spoolsv.exe

Filesize
1.8MB

MD5
f3d2bbf94502d252041c35316a3437be

SHA1
337394ddba850c7e6c937087f93d1fa2dfcad0a2

SHA256
01c233bc78897b0621cc5b0c0aa8275f25209dcf8dd84abe775a6b996da7ee83

SHA512
e56b5f191ade12a301d249e17c3d933fcf11e18a591734b503ee8d106480d2bed92af277aded9c1e4b09b6665fdd1c3bf8069329949a24645b8bc229a8caca3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37e25923-d28c-476e-9d87-1e93bf915e30.tmp

Filesize
10KB

MD5
3b76c11d898864e4daf957c7d7dd0632

SHA1
57416f6f0509d51d3f4b5609e0ddd118a23deb1c

SHA256
358e18c4ff763e1e1438d4de04ec252fc4e850d3d599004eaaaa13dd1d8d8409

SHA512
1259c33ce45dc0cd8b089e934645e52dba55ca997cf62a3135050191361d26603a6c5497d3e64b464b10bcd645aae4a55819d37711c81251dbe0180dddf50708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
abe437a760b3037ebc3942f2092bf073

SHA1
ef92101e5ab57625e97eb98ad340a5e91584ba98

SHA256
5314f050719294cc975f9853f201838e511e8887a259956c57228c567fec25b5

SHA512
76c4839961a9b3e6175d72d96d765eb8f925d93b27116e78d75e864c990e146894fb3581efd7b964c22432537fc5d2fd30694003e5a2793e00a3492bd3e698ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6eb8e5ececc7a09dc2ac977d3aaec53b

SHA1
7e5d7b6ca48f037a4336610d54abb16750a395bf

SHA256
d2962e01a4f085cf0f46b16e9cce2190ce669c520f870e6a6adba72fdc95af38

SHA512
6835d2ce55f0684a866674be3a2ebda6c07326d7e43f668f523268462277e9debf21ca81cf0e1cec45c8408922ddadd8053aee6f6ea83a2c4992f44d24f5df01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0340cda3d1f9b95d3ddb08eb333cab1f

SHA1
29032bea8d2ba555c443b5412af0068bea22c4dd

SHA256
fe0edab059948530b575cc18fc6e873ad481f26a9f80893fec4364002e7ff031

SHA512
06a95d953dc0e47d7fc0c733135f80536cfc8075758920c69a1a226b6ca70217b25732bc125150d100c91c0e8a6014433db9901cf334a70375a728d0f588f562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
436B

MD5
9aefc5d4a545ebe150b9e490c87af802

SHA1
b5e087953e7ca2b3885b7c9a5c120543f71f5419

SHA256
0b2e82f61c3e1add2732c0918b0b9f7ddf7ffe274b8069fba4aaa9925f8110d4

SHA512
8ef0625dc8cd000de95f801d233c0eceeb3b679b8234a50cdc1a745dfb1b41777762d1e1b33be28330efe71a585becffbe25ec070a9b6b8dd20521ac4995325f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3c754b54-8525-4cc7-b31d-8f4bb8a7aead.vbs

Filesize
715B

MD5
3f298c7fd482827f74f90c53040e6b3c

SHA1
2b9df46b3f4f5f2ce7ae0d6022b1a808f8dd40c6

SHA256
ed2c5de706cad3e2a657e7c695ca930bdfc63e2cbed680ffb7cfc178b5e301ad

SHA512
97b5632287531f57badcca402384c13f76dd4564756caccbbecf88a73198ec86f4730432ee1fb6c91cb61da97c915365ea803e542b1897d1b17fdc01c13e7aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\XTPArJRuio.bat

Filesize
204B

MD5
3b6acbde99dfd28d40bc868b115dc5d0

SHA1
2cd360649b5a118f4e48561353563248e162a480

SHA256
0206bfea927c8982ec7cc146a4a67bcc0124bc7bb5393eba9bd04cbbeb8ea017

SHA512
83763576bd23c07dd5a32e2bf0a7449e00c2e3bc511f9d6e8a5a1a43cd48915fa5c24d47b6251497c506562f1e2d4ef53630b730e34dfb5a36fa176db0eccae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_30rxfo40.d01.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c42c9c5b-7736-4dbf-9342-b2d5758916fc.vbs

Filesize
491B

MD5
da244fb01051273e51625ca41341cee1

SHA1
a1181722a9474bbdafd56da228c351915cb5fe7a

SHA256
3c3b59fdd415ae8af804512c039cd8a0a9f8604285840af00e55b44b32e2b10d

SHA512
44e5f9d43fcb9e5336c64a29c31aa0285eb07c9f93c385dfc276ab292217371ab18f2c63d9469e1c62fb7fe0760e6718ed5ad048e9ac17066f2a58f1f1888fc9

Download Submit
C:\Windows\Globalization\unsecapp.exe

Filesize
1.8MB

MD5
4cafc7a17a22a3367de5653c68850e10

SHA1
a4bfea6d2a7de674bbc34cf7d4640a9965362a9b

SHA256
0254356f15c64ea7a303b1f3edbd5066daf3fbb24770bd81b7727b6916e5c255

SHA512
d3f41a1253048cd571a502ba432a8d2af21b6b6c979273ebaeefc40b291c3e72f4ad0bc5fd4d691193c76286442ff4b84d9eba7f8f5f89eed81e61cf0ac77c08

Download Submit
memory/1540-14-0x000000001B550000-0x000000001B55C000-memory.dmp

Filesize
48KB

Download
memory/1540-8-0x000000001AD90000-0x000000001AD98000-memory.dmp

Filesize
32KB

Download
memory/1540-157-0x00007FFD366D3000-0x00007FFD366D5000-memory.dmp

Filesize
8KB

Download
memory/1540-12-0x000000001ADD0000-0x000000001ADDC000-memory.dmp

Filesize
48KB

Download
memory/1540-11-0x000000001ADC0000-0x000000001ADCC000-memory.dmp

Filesize
48KB

Download
memory/1540-174-0x00007FFD366D0000-0x00007FFD37191000-memory.dmp

Filesize
10.8MB

Download
memory/1540-198-0x00007FFD366D0000-0x00007FFD37191000-memory.dmp

Filesize
10.8MB

Download
memory/1540-10-0x000000001ADB0000-0x000000001ADBC000-memory.dmp

Filesize
48KB

Download
memory/1540-222-0x00007FFD366D0000-0x00007FFD37191000-memory.dmp

Filesize
10.8MB

Download
memory/1540-240-0x00007FFD366D0000-0x00007FFD37191000-memory.dmp

Filesize
10.8MB

Download
memory/1540-1-0x0000000000060000-0x000000000022C000-memory.dmp

Filesize
1.8MB

Download
memory/1540-20-0x000000001B7A0000-0x000000001B7AC000-memory.dmp

Filesize
48KB

Download
memory/1540-15-0x000000001B7D0000-0x000000001B7D8000-memory.dmp

Filesize
32KB

Download
memory/1540-7-0x0000000002560000-0x0000000002576000-memory.dmp

Filesize
88KB

Download
memory/1540-0-0x00007FFD366D3000-0x00007FFD366D5000-memory.dmp

Filesize
8KB

Download
memory/1540-13-0x000000001ADE0000-0x000000001ADEC000-memory.dmp

Filesize
48KB

Download
memory/1540-18-0x000000001B780000-0x000000001B78E000-memory.dmp

Filesize
56KB

Download
memory/1540-25-0x00007FFD366D0000-0x00007FFD37191000-memory.dmp

Filesize
10.8MB

Download
memory/1540-16-0x000000001B760000-0x000000001B76C000-memory.dmp

Filesize
48KB

Download
memory/1540-17-0x000000001B770000-0x000000001B77A000-memory.dmp

Filesize
40KB

Download
memory/1540-19-0x000000001B790000-0x000000001B798000-memory.dmp

Filesize
32KB

Download
memory/1540-21-0x000000001B7B0000-0x000000001B7BC000-memory.dmp

Filesize
48KB

Download
memory/1540-9-0x000000001ADA0000-0x000000001ADAA000-memory.dmp

Filesize
40KB

Download
memory/1540-22-0x00007FFD366D0000-0x00007FFD37191000-memory.dmp

Filesize
10.8MB

Download
memory/1540-4-0x000000001B500000-0x000000001B550000-memory.dmp

Filesize
320KB

Download
memory/1540-5-0x00000000009F0000-0x00000000009F8000-memory.dmp

Filesize
32KB

Download
memory/1540-6-0x0000000000A30000-0x0000000000A40000-memory.dmp

Filesize
64KB

Download
memory/1540-3-0x0000000000A10000-0x0000000000A2C000-memory.dmp

Filesize
112KB

Download
memory/1540-2-0x00007FFD366D0000-0x00007FFD37191000-memory.dmp

Filesize
10.8MB

Download
memory/2124-250-0x00000156A1AC0000-0x00000156A1AE2000-memory.dmp

Filesize
136KB

Download