colibri | 84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb

Analysis

max time kernel
118s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Size

4.9MB
MD5

a551b33dc0f7549f006be50fc6507952
SHA1

d3a31a7c16bca75d45a7aa3fdead79a2d0f320e0
SHA256

84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb
SHA512

54b2dc22d820ba70dacc5b76c6522ee85c99c8d3d0512b132d40046c99542e119a34c916b926b140d28c0294012db976c47be7243371cde814266b664193efea
SSDEEP

49152:Ll5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8W:u

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3424	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	4284	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	4284	schtasks.exe	83

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

dwm.exedwm.exedwm.exedwm.exedwm.exe84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/4904-3-0x000000001B810000-0x000000001B93E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
1744	powershell.exe
5020	powershell.exe
2948	powershell.exe
2324	powershell.exe
3928	powershell.exe
4040	powershell.exe
4868	powershell.exe
2456	powershell.exe
2452	powershell.exe
3576	powershell.exe
696	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exedwm.exedwm.exedwm.exedwm.exe84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dwm.exe

Executes dropped EXE 36 IoCs

Processes:

tmp81E4.tmp.exetmp81E4.tmp.exedwm.exetmpBCD8.tmp.exetmpBCD8.tmp.exedwm.exetmpDC85.tmp.exetmpDC85.tmp.exedwm.exetmpF992.tmp.exetmpF992.tmp.exedwm.exetmp17F8.tmp.exetmp17F8.tmp.exedwm.exetmp4ACF.tmp.exetmp4ACF.tmp.exedwm.exetmp68C7.tmp.exetmp68C7.tmp.exedwm.exetmp871D.tmp.exetmp871D.tmp.exedwm.exedwm.exetmpC435.tmp.exetmpC435.tmp.exedwm.exetmpDF8D.tmp.exetmpDF8D.tmp.exedwm.exetmp10FE.tmp.exetmp10FE.tmp.exedwm.exetmp4220.tmp.exetmp4220.tmp.exe

pid	Process
2464	tmp81E4.tmp.exe
3776	tmp81E4.tmp.exe
3584	dwm.exe
2080	tmpBCD8.tmp.exe
4400	tmpBCD8.tmp.exe
4088	dwm.exe
5068	tmpDC85.tmp.exe
2708	tmpDC85.tmp.exe
2452	dwm.exe
4572	tmpF992.tmp.exe
3720	tmpF992.tmp.exe
3708	dwm.exe
4496	tmp17F8.tmp.exe
2600	tmp17F8.tmp.exe
2936	dwm.exe
832	tmp4ACF.tmp.exe
3392	tmp4ACF.tmp.exe
3448	dwm.exe
4400	tmp68C7.tmp.exe
3928	tmp68C7.tmp.exe
2064	dwm.exe
4036	tmp871D.tmp.exe
4968	tmp871D.tmp.exe
3212	dwm.exe
1244	dwm.exe
4956	tmpC435.tmp.exe
1436	tmpC435.tmp.exe
2464	dwm.exe
3068	tmpDF8D.tmp.exe
392	tmpDF8D.tmp.exe
212	dwm.exe
4692	tmp10FE.tmp.exe
4760	tmp10FE.tmp.exe
1392	dwm.exe
1484	tmp4220.tmp.exe
4984	tmp4220.tmp.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

dwm.exedwm.exedwm.exedwm.exe84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

tmp81E4.tmp.exetmpBCD8.tmp.exetmpDC85.tmp.exetmpF992.tmp.exetmp17F8.tmp.exetmp4ACF.tmp.exetmp68C7.tmp.exetmp871D.tmp.exetmpC435.tmp.exetmpDF8D.tmp.exetmp10FE.tmp.exetmp4220.tmp.exe

description	pid	Process	procid_target
PID 2464 set thread context of 3776	2464	tmp81E4.tmp.exe	140
PID 2080 set thread context of 4400	2080	tmpBCD8.tmp.exe	182
PID 5068 set thread context of 2708	5068	tmpDC85.tmp.exe	192
PID 4572 set thread context of 3720	4572	tmpF992.tmp.exe	203
PID 4496 set thread context of 2600	4496	tmp17F8.tmp.exe	212
PID 832 set thread context of 3392	832	tmp4ACF.tmp.exe	222
PID 4400 set thread context of 3928	4400	tmp68C7.tmp.exe	231
PID 4036 set thread context of 4968	4036	tmp871D.tmp.exe	242
PID 4956 set thread context of 1436	4956	tmpC435.tmp.exe	255
PID 3068 set thread context of 392	3068	tmpDF8D.tmp.exe	264
PID 4692 set thread context of 4760	4692	tmp10FE.tmp.exe	273
PID 1484 set thread context of 4984	1484	tmp4220.tmp.exe	282

Drops file in Program Files directory 28 IoCs

Processes:

84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\sysmon.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files (x86)\Windows Sidebar\backgroundTaskHost.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{8A1C963D-7054-4DC6-AA98-9FBFCE5E4C3B}\RCXA664.tmp	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files\Windows Portable Devices\e6c9b481da804f	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files (x86)\Google\Update\Install\{8A1C963D-7054-4DC6-AA98-9FBFCE5E4C3B}\7a0fd90576e088	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files (x86)\Windows Sidebar\eddb19405b7ce1	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files\Windows NT\TableTextService\dwm.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files\Windows NT\TableTextService\6cb0b6c459d5d3	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\sysmon.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\dwm.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files (x86)\Common Files\sysmon.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\RCX8A73.tmp	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files (x86)\Common Files\sysmon.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCX9546.tmp	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\backgroundTaskHost.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\5b884080fd4f94	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files (x86)\Internet Explorer\121e5b5079f7c0	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files (x86)\Common Files\RCX885F.tmp	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{8A1C963D-7054-4DC6-AA98-9FBFCE5E4C3B}\explorer.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files (x86)\Common Files\121e5b5079f7c0	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Program Files (x86)\Google\Update\Install\{8A1C963D-7054-4DC6-AA98-9FBFCE5E4C3B}\explorer.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCXA1FD.tmp	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCX9BF0.tmp	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\RCXA905.tmp	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe

Drops file in Windows directory 12 IoCs

Processes:

84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe

description	ioc	Process
File created	C:\Windows\IME\c5b4cb5e9653cc	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\explorer.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Windows\apppatch\it-IT\RCX97C8.tmp	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Windows\IME\services.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Windows\Prefetch\ReadyBoot\explorer.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Windows\Prefetch\ReadyBoot\7a0fd90576e088	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Windows\apppatch\it-IT\ea9f0e6c9e2dcd	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Windows\apppatch\it-IT\taskhostw.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Windows\IME\RCX99DC.tmp	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Windows\apppatch\it-IT\taskhostw.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File created	C:\Windows\IME\services.exe	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCX83D9.tmp	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

tmpBCD8.tmp.exetmpDC85.tmp.exetmpDF8D.tmp.exetmp10FE.tmp.exetmp4220.tmp.exetmp81E4.tmp.exetmpF992.tmp.exetmp17F8.tmp.exetmp4ACF.tmp.exetmp68C7.tmp.exetmp871D.tmp.exetmpC435.tmp.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBCD8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDC85.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDF8D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp10FE.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4220.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp81E4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF992.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp17F8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4ACF.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp68C7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp871D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC435.tmp.exe

Modifies registry class 13 IoCs

Processes:

dwm.exedwm.exedwm.exedwm.exedwm.exe84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dwm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
3788	schtasks.exe
2280	schtasks.exe
740	schtasks.exe
3768	schtasks.exe
4628	schtasks.exe
2820	schtasks.exe
4008	schtasks.exe
1780	schtasks.exe
3320	schtasks.exe
4868	schtasks.exe
1220	schtasks.exe
1532	schtasks.exe
5020	schtasks.exe
3236	schtasks.exe
1808	schtasks.exe
1472	schtasks.exe
1864	schtasks.exe
1620	schtasks.exe
1444	schtasks.exe
1056	schtasks.exe
4424	schtasks.exe
4920	schtasks.exe
4256	schtasks.exe
4204	schtasks.exe
5048	schtasks.exe
3916	schtasks.exe
4932	schtasks.exe
3208	schtasks.exe
1616	schtasks.exe
2184	schtasks.exe
4844	schtasks.exe
2200	schtasks.exe
4464	schtasks.exe
2248	schtasks.exe
1688	schtasks.exe
2868	schtasks.exe
2340	schtasks.exe
5076	schtasks.exe
4952	schtasks.exe
1744	schtasks.exe
4592	schtasks.exe
1388	schtasks.exe
4752	schtasks.exe
3424	schtasks.exe
1788	schtasks.exe
2412	schtasks.exe
4864	schtasks.exe
5068	schtasks.exe
4304	schtasks.exe
3604	schtasks.exe
5104	schtasks.exe
3116	schtasks.exe
3896	schtasks.exe
4548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

Processes:

84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

pid	Process
4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
696	powershell.exe
696	powershell.exe
1744	powershell.exe
1744	powershell.exe
5020	powershell.exe
5020	powershell.exe
4868	powershell.exe
4868	powershell.exe
2324	powershell.exe
2324	powershell.exe
3576	powershell.exe
3576	powershell.exe
3928	powershell.exe
3928	powershell.exe
2948	powershell.exe
2948	powershell.exe
5020	powershell.exe
2452	powershell.exe
2452	powershell.exe
2456	powershell.exe
2456	powershell.exe
2324	powershell.exe
4040	powershell.exe
4040	powershell.exe
4868	powershell.exe
4040	powershell.exe
2948	powershell.exe
696	powershell.exe
2456	powershell.exe
3928	powershell.exe
2452	powershell.exe
1744	powershell.exe
3576	powershell.exe
3584	dwm.exe
3584	dwm.exe
4088	dwm.exe
2452	dwm.exe
3708	dwm.exe
2936	dwm.exe
3448	dwm.exe
2064	dwm.exe
3212	dwm.exe
1244	dwm.exe
2464	dwm.exe
212	dwm.exe
1392	dwm.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

description	pid	Process
Token: SeDebugPrivilege	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Token: SeDebugPrivilege	696	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	3584	dwm.exe
Token: SeDebugPrivilege	4088	dwm.exe
Token: SeDebugPrivilege	2452	dwm.exe
Token: SeDebugPrivilege	3708	dwm.exe
Token: SeDebugPrivilege	2936	dwm.exe
Token: SeDebugPrivilege	3448	dwm.exe
Token: SeDebugPrivilege	2064	dwm.exe
Token: SeDebugPrivilege	3212	dwm.exe
Token: SeDebugPrivilege	1244	dwm.exe
Token: SeDebugPrivilege	2464	dwm.exe
Token: SeDebugPrivilege	212	dwm.exe
Token: SeDebugPrivilege	1392	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exetmp81E4.tmp.exedwm.exetmpBCD8.tmp.exeWScript.exedwm.exetmpDC85.tmp.exe

description	pid	Process	procid_target
PID 4904 wrote to memory of 2464	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	138
PID 4904 wrote to memory of 2464	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	138
PID 4904 wrote to memory of 2464	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	138
PID 2464 wrote to memory of 3776	2464	tmp81E4.tmp.exe	140
PID 2464 wrote to memory of 3776	2464	tmp81E4.tmp.exe	140
PID 2464 wrote to memory of 3776	2464	tmp81E4.tmp.exe	140
PID 2464 wrote to memory of 3776	2464	tmp81E4.tmp.exe	140
PID 2464 wrote to memory of 3776	2464	tmp81E4.tmp.exe	140
PID 2464 wrote to memory of 3776	2464	tmp81E4.tmp.exe	140
PID 2464 wrote to memory of 3776	2464	tmp81E4.tmp.exe	140
PID 4904 wrote to memory of 4040	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	151
PID 4904 wrote to memory of 4040	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	151
PID 4904 wrote to memory of 696	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	152
PID 4904 wrote to memory of 696	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	152
PID 4904 wrote to memory of 4868	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	153
PID 4904 wrote to memory of 4868	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	153
PID 4904 wrote to memory of 3928	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	154
PID 4904 wrote to memory of 3928	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	154
PID 4904 wrote to memory of 2324	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	155
PID 4904 wrote to memory of 2324	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	155
PID 4904 wrote to memory of 3576	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	156
PID 4904 wrote to memory of 3576	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	156
PID 4904 wrote to memory of 2452	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	157
PID 4904 wrote to memory of 2452	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	157
PID 4904 wrote to memory of 2948	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	158
PID 4904 wrote to memory of 2948	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	158
PID 4904 wrote to memory of 5020	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	160
PID 4904 wrote to memory of 5020	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	160
PID 4904 wrote to memory of 2456	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	161
PID 4904 wrote to memory of 2456	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	161
PID 4904 wrote to memory of 1744	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	164
PID 4904 wrote to memory of 1744	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	164
PID 4904 wrote to memory of 3584	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	174
PID 4904 wrote to memory of 3584	4904	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe	174
PID 3584 wrote to memory of 3560	3584	dwm.exe	177
PID 3584 wrote to memory of 3560	3584	dwm.exe	177
PID 3584 wrote to memory of 4368	3584	dwm.exe	178
PID 3584 wrote to memory of 4368	3584	dwm.exe	178
PID 3584 wrote to memory of 2080	3584	dwm.exe	180
PID 3584 wrote to memory of 2080	3584	dwm.exe	180
PID 3584 wrote to memory of 2080	3584	dwm.exe	180
PID 2080 wrote to memory of 4400	2080	tmpBCD8.tmp.exe	182
PID 2080 wrote to memory of 4400	2080	tmpBCD8.tmp.exe	182
PID 2080 wrote to memory of 4400	2080	tmpBCD8.tmp.exe	182
PID 2080 wrote to memory of 4400	2080	tmpBCD8.tmp.exe	182
PID 2080 wrote to memory of 4400	2080	tmpBCD8.tmp.exe	182
PID 2080 wrote to memory of 4400	2080	tmpBCD8.tmp.exe	182
PID 2080 wrote to memory of 4400	2080	tmpBCD8.tmp.exe	182
PID 3560 wrote to memory of 4088	3560	WScript.exe	185
PID 3560 wrote to memory of 4088	3560	WScript.exe	185
PID 4088 wrote to memory of 4828	4088	dwm.exe	187
PID 4088 wrote to memory of 4828	4088	dwm.exe	187
PID 4088 wrote to memory of 5064	4088	dwm.exe	188
PID 4088 wrote to memory of 5064	4088	dwm.exe	188
PID 4088 wrote to memory of 5068	4088	dwm.exe	190
PID 4088 wrote to memory of 5068	4088	dwm.exe	190
PID 4088 wrote to memory of 5068	4088	dwm.exe	190
PID 5068 wrote to memory of 2708	5068	tmpDC85.tmp.exe	192
PID 5068 wrote to memory of 2708	5068	tmpDC85.tmp.exe	192
PID 5068 wrote to memory of 2708	5068	tmpDC85.tmp.exe	192
PID 5068 wrote to memory of 2708	5068	tmpDC85.tmp.exe	192
PID 5068 wrote to memory of 2708	5068	tmpDC85.tmp.exe	192
PID 5068 wrote to memory of 2708	5068	tmpDC85.tmp.exe	192
PID 5068 wrote to memory of 2708	5068	tmpDC85.tmp.exe	192

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

Processes:

dwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe
"C:\Users\Admin\AppData\Local\Temp\84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4904
- C:\Users\Admin\AppData\Local\Temp\tmp81E4.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp81E4.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Users\Admin\AppData\Local\Temp\tmp81E4.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp81E4.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:3776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Program Files\Windows NT\TableTextService\dwm.exe
  "C:\Program Files\Windows NT\TableTextService\dwm.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3584
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37cc063a-b844-429e-95c9-cba6e8c52993.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Program Files\Windows NT\TableTextService\dwm.exe
      "C:\Program Files\Windows NT\TableTextService\dwm.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4088
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae38a65a-b0ab-4dd8-b377-67e1691e8138.vbs"
        5⤵
        
        PID:4828
      - C:\Program Files\Windows NT\TableTextService\dwm.exe
        
        "C:\Program Files\Windows NT\TableTextService\dwm.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2452
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df698c2e-f317-4f95-b81a-3c825970c8db.vbs"
        7⤵
        
        PID:3752
        
        C:\Program Files\Windows NT\TableTextService\dwm.exe
        
        "C:\Program Files\Windows NT\TableTextService\dwm.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f296b77c-a01b-4bbf-bd23-e46d61b2e59e.vbs"
        9⤵
        
        PID:2204
        
        C:\Program Files\Windows NT\TableTextService\dwm.exe
        
        "C:\Program Files\Windows NT\TableTextService\dwm.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b9e2bcfa-b215-41b1-b9af-dcccf5da340c.vbs"
        11⤵
        
        PID:1532
        
        C:\Program Files\Windows NT\TableTextService\dwm.exe
        
        "C:\Program Files\Windows NT\TableTextService\dwm.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea66e6dd-8903-4f73-9811-60ae518c7ad0.vbs"
        13⤵
        
        PID:1540
        
        C:\Program Files\Windows NT\TableTextService\dwm.exe
        
        "C:\Program Files\Windows NT\TableTextService\dwm.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\352b41cc-981b-4417-ac2b-a7bcfc50f740.vbs"
        15⤵
        
        PID:3940
        
        C:\Program Files\Windows NT\TableTextService\dwm.exe
        
        "C:\Program Files\Windows NT\TableTextService\dwm.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3212
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39dbbc85-f929-468e-b60f-351ac3e35454.vbs"
        17⤵
        
        PID:3316
        
        C:\Program Files\Windows NT\TableTextService\dwm.exe
        
        "C:\Program Files\Windows NT\TableTextService\dwm.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1244
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35060bda-9942-426f-8b5b-e63bbd0048c9.vbs"
        19⤵
        
        PID:1444
        
        C:\Program Files\Windows NT\TableTextService\dwm.exe
        
        "C:\Program Files\Windows NT\TableTextService\dwm.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c231c76-b435-4cad-ba14-be8baaeb04ca.vbs"
        21⤵
        
        PID:1504
        
        C:\Program Files\Windows NT\TableTextService\dwm.exe
        
        "C:\Program Files\Windows NT\TableTextService\dwm.exe"
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:212
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1028d5c8-08a1-49a7-ba8b-d1ac961ddd71.vbs"
        23⤵
        
        PID:2788
        
        C:\Program Files\Windows NT\TableTextService\dwm.exe
        
        "C:\Program Files\Windows NT\TableTextService\dwm.exe"
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18ee2fc3-89f4-49b7-b262-45304de56a34.vbs"
        25⤵
        
        PID:1212
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\56bef7db-3f16-4c97-94cd-8ce2ea2511c3.vbs"
        25⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\tmp4220.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4220.tmp.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\tmp4220.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4220.tmp.exe"
        26⤵
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96fd9129-8cba-4e68-923f-253a8533a015.vbs"
        23⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\tmp10FE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp10FE.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\tmp10FE.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp10FE.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d0aa3fe-e453-43fd-b61a-34b41ac14e7f.vbs"
        21⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\tmpDF8D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDF8D.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\tmpDF8D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDF8D.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67d34c06-e718-4c00-acbc-b4825fa2ce27.vbs"
        19⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\tmpC435.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC435.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\tmpC435.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC435.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:1436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72935487-bc93-4cb7-9a5f-1a7bc6a4e77e.vbs"
        17⤵
        
        PID:5096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\543b9f52-9eeb-438f-a5d5-b0eefc60760d.vbs"
        15⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\tmp871D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp871D.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\tmp871D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp871D.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:4968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aade16dd-0332-4087-aa1f-ef23e94e86ca.vbs"
        13⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\tmp68C7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp68C7.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\tmp68C7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp68C7.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:3928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b67e531-6d9a-464d-98ad-a789492fa585.vbs"
        11⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\tmp4ACF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4ACF.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\tmp4ACF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4ACF.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:3392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5999f913-7f3e-473f-8a1d-208c4d946d7d.vbs"
        9⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\tmp17F8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp17F8.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\tmp17F8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp17F8.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:2600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3828139-ccf7-478e-833e-7c59f4a52209.vbs"
        7⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\tmpF992.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF992.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\tmpF992.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF992.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:3720
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3757672-e6e0-49ad-b8d6-a6549929686a.vbs"
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\tmpDC85.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDC85.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\tmpDC85.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDC85.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:2708
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d953ee61-1256-49b0-802a-5b86087b8df2.vbs"
    3⤵
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\tmpBCD8.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpBCD8.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\tmpBCD8.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpBCD8.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\ReadyBoot\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows\Prefetch\ReadyBoot\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\apppatch\it-IT\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\apppatch\it-IT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Windows\apppatch\it-IT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\IME\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\IME\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Desktop\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Videos\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Default\Videos\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Videos\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Update\Install\{8A1C963D-7054-4DC6-AA98-9FBFCE5E4C3B}\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Install\{8A1C963D-7054-4DC6-AA98-9FBFCE5E4C3B}\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Update\Install\{8A1C963D-7054-4DC6-AA98-9FBFCE5E4C3B}\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\TableTextService\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\Install\{8A1C963D-7054-4DC6-AA98-9FBFCE5E4C3B}\explorer.exe

Filesize
4.9MB

MD5
2bf899fe1aa0c3741e1501fe8b0251ff

SHA1
dadc46927d7056a10a189e13f28b879785780d22

SHA256
135da6d3bd17373823729476b854d4e66c074e933e2f82e4b1456cf8075321e1

SHA512
1fb3aaa074bc087b36523bad684cf42a5ce7f1e8509b2ba06c91cab1e8705826a110b5d32d54fc4de3c96fe938fa7357463b8dcc8160a5fe08cdf97b2fff2808

Download Submit
C:\Program Files (x86)\Windows Defender\de-DE\fontdrvhost.exe

Filesize
4.9MB

MD5
a551b33dc0f7549f006be50fc6507952

SHA1
d3a31a7c16bca75d45a7aa3fdead79a2d0f320e0

SHA256
84e10303e612ad6ab5759d5e0fc11a123a6014da30dd7320d4c4329f4ca5abbb

SHA512
54b2dc22d820ba70dacc5b76c6522ee85c99c8d3d0512b132d40046c99542e119a34c916b926b140d28c0294012db976c47be7243371cde814266b664193efea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\352b41cc-981b-4417-ac2b-a7bcfc50f740.vbs

Filesize
728B

MD5
0d0538c652c646c9e86db69712faa99e

SHA1
943764cbd98e4e4472ef56e80cc2088bb0256917

SHA256
bf1e1c248d286cb35b5460dc530b229cd2667c618e793c147a113d0a23feccc0

SHA512
f615838a4ad0bac08b98de5fb7c1e611f7b9dc597ce4cb4a09294c364a1ce9a925dcc09cbbc90572cfbe253b108e79b0d8533ac59a8de9de955043618f920446

Download Submit
C:\Users\Admin\AppData\Local\Temp\37cc063a-b844-429e-95c9-cba6e8c52993.vbs

Filesize
728B

MD5
c3e942d90aa6e25df9aba79fc3ee698f

SHA1
8320541e03b11a6b7b8634ef52d82d1c9f70397c

SHA256
9455eeeaab5443589c5f6dcdf3c12cd89a79862e10375951c38ebe469d781e5d

SHA512
b44a48c7d67638eb45fadfb23c34532f3edd5ddadd618e5ce7a4ffabd06286a2789210ce23c3b69418348af13463ec5c93c38a3d10237ebe9c575994c190934b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5wekpxlh.tml.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ae38a65a-b0ab-4dd8-b377-67e1691e8138.vbs

Filesize
728B

MD5
827c9cddfa0766a22a98a372a3b5cc22

SHA1
e08e0b82c959029673d013b5abc3a9ac6f3d0bf6

SHA256
9b1be65ae1c50b34e32cedd3362aee2c3409763537ad74f820455f4b21b6307e

SHA512
7a7d5e1e99e3f3ed7a1871bea5bf6dbe446eff3204f292e0511eba7679e362a78a90095dab0cf0ec7003bb481cbf47ba15f77d5ab516fa1cdeca765c1810d809

Download Submit
C:\Users\Admin\AppData\Local\Temp\b9e2bcfa-b215-41b1-b9af-dcccf5da340c.vbs

Filesize
728B

MD5
deff181df84000c5eaf534f0359ce3dd

SHA1
847096a94187b99c02a95b824ddb899d3f746f59

SHA256
da0db29498579ca5eba11b0e1466f60b7aac517cbbe7f9fda35b6339e5c15a01

SHA512
b9c767deddf4cd37cb1ea3c87132e631fe866d008b273dc9631d17d1c330f91ce351cf34572779cf182210b09ce6dcec9558b0a18e3a25665ce42c00dfdbb40e

Download Submit
C:\Users\Admin\AppData\Local\Temp\d953ee61-1256-49b0-802a-5b86087b8df2.vbs

Filesize
504B

MD5
b0bb8250b215a664c706505e23d550d4

SHA1
2b111b886f00304c156a8f167528cf85adebde52

SHA256
d5418f7f5e37d136f6fd82f977e86c4e971b8daca68bbb888acdc408531ccff8

SHA512
25c0c9b90f193da5ee7fa8989a9539fc560cba606a762bd662d1369c7f73a0d3553b33ddb6b09731672294178ab464766bed98868592063843ed269d484efd27

Download Submit
C:\Users\Admin\AppData\Local\Temp\df698c2e-f317-4f95-b81a-3c825970c8db.vbs

Filesize
728B

MD5
e46f0b301908fb37261c37e96e0237ff

SHA1
7afa5f9fea6033ec86153d02489ab7b836128fa3

SHA256
c8968456eb2b67240ccb4984065f24b50c5ac7ccc3e18eac1d834f58ab6da22f

SHA512
1ade309af74fb4cc4b1db70484b6998e59fc62fa2515cb13201cbbd02a00eb86f8bf814acab02e613e2a2788a99d823bb608c045147f1ce70b632cd8345fda3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ea66e6dd-8903-4f73-9811-60ae518c7ad0.vbs

Filesize
728B

MD5
50e814fce708d36a83c0c40227c81a4e

SHA1
37993c0f1c4e0a4d3df504a7ffb8afb9b4bd0861

SHA256
6990251af4b75951fdb09b3ca8871d3791493e43f7693a62ed8fa73934bef085

SHA512
791fd617e98787496ebf8538af8b54d8cca63901eee08d23ef614b8a36d2e6e303ada89596a3d51a7495481dccc4e12c0a1f726bd1dd3c6ee68e06db7f4c319e

Download Submit
C:\Users\Admin\AppData\Local\Temp\f296b77c-a01b-4bbf-bd23-e46d61b2e59e.vbs

Filesize
728B

MD5
5d11fb3112a6c1054400b0c93b581023

SHA1
246980265f09a63996d0090c0e6ebcbdb7a5ef35

SHA256
76ba64d54bf093736de8b637c59c2b542f76c76ee695b94a22c3c97a6c3871cb

SHA512
fd18696542da6e0a6acc846a7bf36808e697a790613ce461a67e79dfcf617f38a84821d51d5a52a7ec37aa1ba3b93e6c453e0c10cad6c89a9a0ef7fc70ca8e8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp81E4.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Default\Desktop\smss.exe

Filesize
4.9MB

MD5
11edbbb8f5c01bc252a3cf5e70079f94

SHA1
bc8dea184b9be4e63bd4d6f92d5e880c2895caef

SHA256
45d18663fc0ef2f8327579dcac7e27e30238e3cedacc5bc4cd7b526efd240498

SHA512
990c5d8667b8235ed350aa2f1b45f987881fc9a0597042fde3d0d647d9af6b90d9509417f3923194e8ed52b424515ef1cd3c2034b4927dd438833a91eadf5935

Download Submit
memory/1244-547-0x000000001C770000-0x000000001C782000-memory.dmp

Filesize
72KB

Download
memory/1392-596-0x000000001BAD0000-0x000000001BAE2000-memory.dmp

Filesize
72KB

Download
memory/2936-469-0x0000000002FC0000-0x0000000002FD2000-memory.dmp

Filesize
72KB

Download
memory/3776-74-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4904-10-0x000000001BFA0000-0x000000001BFAA000-memory.dmp

Filesize
40KB

Download
memory/4904-15-0x000000001C030000-0x000000001C03E000-memory.dmp

Filesize
56KB

Download
memory/4904-1-0x00000000005C0000-0x0000000000AB4000-memory.dmp

Filesize
5.0MB

Download
memory/4904-144-0x00007FFB42953000-0x00007FFB42955000-memory.dmp

Filesize
8KB

Download
memory/4904-352-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

Filesize
10.8MB

Download
memory/4904-16-0x000000001C040000-0x000000001C048000-memory.dmp

Filesize
32KB

Download
memory/4904-18-0x000000001C060000-0x000000001C06C000-memory.dmp

Filesize
48KB

Download
memory/4904-17-0x000000001C050000-0x000000001C058000-memory.dmp

Filesize
32KB

Download
memory/4904-12-0x000000001C550000-0x000000001CA78000-memory.dmp

Filesize
5.2MB

Download
memory/4904-13-0x000000001BFC0000-0x000000001BFCA000-memory.dmp

Filesize
40KB

Download
memory/4904-14-0x000000001C020000-0x000000001C02E000-memory.dmp

Filesize
56KB

Download
memory/4904-158-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

Filesize
10.8MB

Download
memory/4904-0-0x00007FFB42953000-0x00007FFB42955000-memory.dmp

Filesize
8KB

Download
memory/4904-11-0x000000001BFB0000-0x000000001BFC2000-memory.dmp

Filesize
72KB

Download
memory/4904-8-0x000000001BF80000-0x000000001BF96000-memory.dmp

Filesize
88KB

Download
memory/4904-9-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/4904-5-0x000000001BFD0000-0x000000001C020000-memory.dmp

Filesize
320KB

Download
memory/4904-6-0x00000000013C0000-0x00000000013C8000-memory.dmp

Filesize
32KB

Download
memory/4904-7-0x00000000013E0000-0x00000000013F0000-memory.dmp

Filesize
64KB

Download
memory/4904-4-0x000000001B7E0000-0x000000001B7FC000-memory.dmp

Filesize
112KB

Download
memory/4904-3-0x000000001B810000-0x000000001B93E000-memory.dmp

Filesize
1.2MB

Download
memory/4904-2-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

Filesize
10.8MB

Download
memory/5020-250-0x000001C820F10000-0x000001C820F32000-memory.dmp

Filesize
136KB

Download