colibri | 43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Size

4.9MB
MD5

583b26ac46872fddf808789e82a9f2af
SHA1

9546b2719df0b0cb760440605dc5b2cf8d7a45e5
SHA256

43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a
SHA512

2a31ee6d45fc58c8162d62add81a7c53282e33034cfd5eadcc0b5db7e12003aad7575a4c9683ad3384fc18e44224e331ad5b7b2ac0365841d0b0176e37a0e78f
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	972	schtasks.exe	82

UAC bypass 3 TTPs 51 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4544-3-0x000000001BD00000-0x000000001BE2E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2696	powershell.exe
4200	powershell.exe
1884	powershell.exe
2924	powershell.exe
3984	powershell.exe
3576	powershell.exe
1124	powershell.exe
2976	powershell.exe
4128	powershell.exe
4164	powershell.exe
2344	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	TextInputHost.exe

Executes dropped EXE 53 IoCs

pid	Process
3112	tmpC47D.tmp.exe
2300	tmpC47D.tmp.exe
4888	tmpC47D.tmp.exe
4652	TextInputHost.exe
3788	tmpEA41.tmp.exe
1604	tmpEA41.tmp.exe
4504	TextInputHost.exe
2008	tmpAD8.tmp.exe
2716	tmpAD8.tmp.exe
4408	tmpAD8.tmp.exe
4428	TextInputHost.exe
1100	tmp2769.tmp.exe
2264	tmp2769.tmp.exe
4156	TextInputHost.exe
1556	tmp439C.tmp.exe
2492	tmp439C.tmp.exe
3688	tmp439C.tmp.exe
5048	TextInputHost.exe
1040	tmp5F80.tmp.exe
752	tmp5F80.tmp.exe
4936	TextInputHost.exe
3884	tmp7BF1.tmp.exe
3800	tmp7BF1.tmp.exe
3432	TextInputHost.exe
2556	tmp9A28.tmp.exe
4788	tmp9A28.tmp.exe
5064	TextInputHost.exe
4824	tmpC9E3.tmp.exe
4504	tmpC9E3.tmp.exe
3852	TextInputHost.exe
4280	tmpE598.tmp.exe
3504	tmpE598.tmp.exe
1092	tmpE598.tmp.exe
1512	TextInputHost.exe
2120	TextInputHost.exe
1548	TextInputHost.exe
3164	tmp3927.tmp.exe
5108	tmp3927.tmp.exe
3664	tmp3927.tmp.exe
804	TextInputHost.exe
1728	tmp696E.tmp.exe
2964	tmp696E.tmp.exe
1116	TextInputHost.exe
1468	tmp9AA0.tmp.exe
2936	tmp9AA0.tmp.exe
4124	TextInputHost.exe
228	tmpCAE7.tmp.exe
1608	tmpCAE7.tmp.exe
1816	tmpCAE7.tmp.exe
4472	tmpCAE7.tmp.exe
1280	TextInputHost.exe
4484	tmpE891.tmp.exe
2360	tmpE891.tmp.exe

Checks whether UAC is enabled 1 TTPs 34 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 2300 set thread context of 4888	2300	tmpC47D.tmp.exe	119
PID 3788 set thread context of 1604	3788	tmpEA41.tmp.exe	150
PID 2716 set thread context of 4408	2716	tmpAD8.tmp.exe	160
PID 1100 set thread context of 2264	1100	tmp2769.tmp.exe	166
PID 2492 set thread context of 3688	2492	tmp439C.tmp.exe	175
PID 1040 set thread context of 752	1040	tmp5F80.tmp.exe	181
PID 3884 set thread context of 3800	3884	tmp7BF1.tmp.exe	187
PID 2556 set thread context of 4788	2556	tmp9A28.tmp.exe	193
PID 4824 set thread context of 4504	4824	tmpC9E3.tmp.exe	199
PID 3504 set thread context of 1092	3504	tmpE598.tmp.exe	206
PID 5108 set thread context of 3664	5108	tmp3927.tmp.exe	219
PID 1728 set thread context of 2964	1728	tmp696E.tmp.exe	225
PID 1468 set thread context of 2936	1468	tmp9AA0.tmp.exe	231
PID 1816 set thread context of 4472	1816	tmpCAE7.tmp.exe	239
PID 4484 set thread context of 2360	4484	tmpE891.tmp.exe	245

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Program Files\dotnet\taskhostw.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\de-DE\RCXCB36.tmp	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Program Files\dotnet\taskhostw.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Program Files\dotnet\ea9f0e6c9e2dcd	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\38384e6a620884	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\de-DE\SearchApp.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXD462.tmp	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\SearchApp.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\7a0fd90576e088	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Program Files\dotnet\RCXC8F3.tmp	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\L2Schemas\explorer.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Windows\L2Schemas\explorer.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Windows\Vss\Writers\Application\RCXC662.tmp	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Windows\L2Schemas\7a0fd90576e088	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Windows\Vss\Writers\Application\TextInputHost.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Windows\Vss\Writers\Application\22eafd247d37c3	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File created	C:\Windows\servicing\csrss.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Windows\L2Schemas\RCXC024.tmp	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
File opened for modification	C:\Windows\Vss\Writers\Application\TextInputHost.exe	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC9E3.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE598.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC47D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC47D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp439C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9A28.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3927.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp696E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpEA41.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2769.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3927.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCAE7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7BF1.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE598.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp439C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5F80.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9AA0.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCAE7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCAE7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE891.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAD8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAD8.tmp.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	TextInputHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2716	schtasks.exe
3436	schtasks.exe
4448	schtasks.exe
3092	schtasks.exe
436	schtasks.exe
3468	schtasks.exe
3688	schtasks.exe
4532	schtasks.exe
1040	schtasks.exe
2864	schtasks.exe
4000	schtasks.exe
4688	schtasks.exe
468	schtasks.exe
1560	schtasks.exe
2084	schtasks.exe
2276	schtasks.exe
2132	schtasks.exe
404	schtasks.exe
5064	schtasks.exe
4580	schtasks.exe
212	schtasks.exe
3232	schtasks.exe
2360	schtasks.exe
3888	schtasks.exe
4584	schtasks.exe
5092	schtasks.exe
4784	schtasks.exe
3632	schtasks.exe
1800	schtasks.exe
3440	schtasks.exe
4508	schtasks.exe
3952	schtasks.exe
2752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
2976	powershell.exe
2976	powershell.exe
2696	powershell.exe
2696	powershell.exe
2344	powershell.exe
2344	powershell.exe
3576	powershell.exe
3576	powershell.exe
4200	powershell.exe
4200	powershell.exe
1884	powershell.exe
1884	powershell.exe
1124	powershell.exe
1124	powershell.exe
4164	powershell.exe
4164	powershell.exe
2924	powershell.exe
2924	powershell.exe
3984	powershell.exe
3984	powershell.exe
4128	powershell.exe
4128	powershell.exe
3576	powershell.exe
4164	powershell.exe
2696	powershell.exe
2976	powershell.exe
2344	powershell.exe
1124	powershell.exe
3984	powershell.exe
4200	powershell.exe
1884	powershell.exe
4128	powershell.exe
2924	powershell.exe
4652	TextInputHost.exe
4652	TextInputHost.exe
4504	TextInputHost.exe
4428	TextInputHost.exe
4156	TextInputHost.exe
5048	TextInputHost.exe
4936	TextInputHost.exe
3432	TextInputHost.exe
5064	TextInputHost.exe
3852	TextInputHost.exe
1512	TextInputHost.exe
2120	TextInputHost.exe
1548	TextInputHost.exe
804	TextInputHost.exe
1116	TextInputHost.exe
4124	TextInputHost.exe
1280	TextInputHost.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4652	TextInputHost.exe
Token: SeDebugPrivilege	4504	TextInputHost.exe
Token: SeDebugPrivilege	4428	TextInputHost.exe
Token: SeDebugPrivilege	4156	TextInputHost.exe
Token: SeDebugPrivilege	5048	TextInputHost.exe
Token: SeDebugPrivilege	4936	TextInputHost.exe
Token: SeDebugPrivilege	3432	TextInputHost.exe
Token: SeDebugPrivilege	5064	TextInputHost.exe
Token: SeDebugPrivilege	3852	TextInputHost.exe
Token: SeDebugPrivilege	1512	TextInputHost.exe
Token: SeDebugPrivilege	2120	TextInputHost.exe
Token: SeDebugPrivilege	1548	TextInputHost.exe
Token: SeDebugPrivilege	804	TextInputHost.exe
Token: SeDebugPrivilege	1116	TextInputHost.exe
Token: SeDebugPrivilege	4124	TextInputHost.exe
Token: SeDebugPrivilege	1280	TextInputHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 3112	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	116
PID 4544 wrote to memory of 3112	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	116
PID 4544 wrote to memory of 3112	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	116
PID 3112 wrote to memory of 2300	3112	tmpC47D.tmp.exe	118
PID 3112 wrote to memory of 2300	3112	tmpC47D.tmp.exe	118
PID 3112 wrote to memory of 2300	3112	tmpC47D.tmp.exe	118
PID 2300 wrote to memory of 4888	2300	tmpC47D.tmp.exe	119
PID 2300 wrote to memory of 4888	2300	tmpC47D.tmp.exe	119
PID 2300 wrote to memory of 4888	2300	tmpC47D.tmp.exe	119
PID 2300 wrote to memory of 4888	2300	tmpC47D.tmp.exe	119
PID 2300 wrote to memory of 4888	2300	tmpC47D.tmp.exe	119
PID 2300 wrote to memory of 4888	2300	tmpC47D.tmp.exe	119
PID 2300 wrote to memory of 4888	2300	tmpC47D.tmp.exe	119
PID 4544 wrote to memory of 4128	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	122
PID 4544 wrote to memory of 4128	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	122
PID 4544 wrote to memory of 2976	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	123
PID 4544 wrote to memory of 2976	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	123
PID 4544 wrote to memory of 2696	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	124
PID 4544 wrote to memory of 2696	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	124
PID 4544 wrote to memory of 3576	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	125
PID 4544 wrote to memory of 3576	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	125
PID 4544 wrote to memory of 3984	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	126
PID 4544 wrote to memory of 3984	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	126
PID 4544 wrote to memory of 2924	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	127
PID 4544 wrote to memory of 2924	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	127
PID 4544 wrote to memory of 2344	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	128
PID 4544 wrote to memory of 2344	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	128
PID 4544 wrote to memory of 4164	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	129
PID 4544 wrote to memory of 4164	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	129
PID 4544 wrote to memory of 4200	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	130
PID 4544 wrote to memory of 4200	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	130
PID 4544 wrote to memory of 1124	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	131
PID 4544 wrote to memory of 1124	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	131
PID 4544 wrote to memory of 1884	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	132
PID 4544 wrote to memory of 1884	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	132
PID 4544 wrote to memory of 4652	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	144
PID 4544 wrote to memory of 4652	4544	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe	144
PID 4652 wrote to memory of 2628	4652	TextInputHost.exe	146
PID 4652 wrote to memory of 2628	4652	TextInputHost.exe	146
PID 4652 wrote to memory of 3368	4652	TextInputHost.exe	147
PID 4652 wrote to memory of 3368	4652	TextInputHost.exe	147
PID 4652 wrote to memory of 3788	4652	TextInputHost.exe	148
PID 4652 wrote to memory of 3788	4652	TextInputHost.exe	148
PID 4652 wrote to memory of 3788	4652	TextInputHost.exe	148
PID 3788 wrote to memory of 1604	3788	tmpEA41.tmp.exe	150
PID 3788 wrote to memory of 1604	3788	tmpEA41.tmp.exe	150
PID 3788 wrote to memory of 1604	3788	tmpEA41.tmp.exe	150
PID 3788 wrote to memory of 1604	3788	tmpEA41.tmp.exe	150
PID 3788 wrote to memory of 1604	3788	tmpEA41.tmp.exe	150
PID 3788 wrote to memory of 1604	3788	tmpEA41.tmp.exe	150
PID 3788 wrote to memory of 1604	3788	tmpEA41.tmp.exe	150
PID 2628 wrote to memory of 4504	2628	WScript.exe	154
PID 2628 wrote to memory of 4504	2628	WScript.exe	154
PID 4504 wrote to memory of 2440	4504	TextInputHost.exe	155
PID 4504 wrote to memory of 2440	4504	TextInputHost.exe	155
PID 4504 wrote to memory of 2568	4504	TextInputHost.exe	156
PID 4504 wrote to memory of 2568	4504	TextInputHost.exe	156
PID 4504 wrote to memory of 2008	4504	TextInputHost.exe	157
PID 4504 wrote to memory of 2008	4504	TextInputHost.exe	157
PID 4504 wrote to memory of 2008	4504	TextInputHost.exe	157
PID 2008 wrote to memory of 2716	2008	tmpAD8.tmp.exe	159
PID 2008 wrote to memory of 2716	2008	tmpAD8.tmp.exe	159
PID 2008 wrote to memory of 2716	2008	tmpAD8.tmp.exe	159
PID 2716 wrote to memory of 4408	2716	tmpAD8.tmp.exe	160

System policy modification 1 TTPs 51 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	TextInputHost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe
"C:\Users\Admin\AppData\Local\Temp\43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4544
- C:\Users\Admin\AppData\Local\Temp\tmpC47D.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpC47D.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Users\Admin\AppData\Local\Temp\tmpC47D.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpC47D.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\tmpC47D.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpC47D.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\Vss\Writers\Application\TextInputHost.exe
  "C:\Windows\Vss\Writers\Application\TextInputHost.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4652
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\254aeb10-e3d9-46b0-928b-27e1421d820d.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\Vss\Writers\Application\TextInputHost.exe
      C:\Windows\Vss\Writers\Application\TextInputHost.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4504
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\790eb66f-ccc4-4a8b-8434-0bbbe6210691.vbs"
        5⤵
        
        PID:2440
      - C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4428
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1ce117a-4274-449e-b70c-1825a788dc40.vbs"
        7⤵
        
        PID:2584
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4156
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d57eabc8-8b5c-40e9-b8ca-da82663a91bb.vbs"
        9⤵
        
        PID:3996
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5048
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b78fe18-5886-4e3b-b988-a3cf5eff5bb8.vbs"
        11⤵
        
        PID:2992
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\144459db-b76f-4a7d-b4ea-8ab802f720d5.vbs"
        13⤵
        
        PID:3768
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8bc89549-dac9-4106-9af6-62d7f0e98b51.vbs"
        15⤵
        
        PID:4472
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f9bf62b-a192-42bf-ad6e-927e7e8a1636.vbs"
        17⤵
        
        PID:2008
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9cbb6d7-224e-4cbf-a1b2-c303bb4b466c.vbs"
        19⤵
        
        PID:3492
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1512
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0d1a26f-5ec9-48be-a5bd-2c5443b2e47a.vbs"
        21⤵
        
        PID:4592
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1dbf341-996b-4306-b0b9-fbba2cbad856.vbs"
        23⤵
        
        PID:392
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\522b3ae4-a3a0-4dca-ac41-b5c74340020a.vbs"
        25⤵
        
        PID:4484
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        26⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6fa944c-c9af-499b-897f-09552bb4afc1.vbs"
        27⤵
        
        PID:2440
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        28⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1116
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a53117f-999b-4dae-aa4f-bd2848ddd676.vbs"
        29⤵
        
        PID:832
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        30⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce2ef1e3-28d7-4d36-bc4c-bbf43b554eb9.vbs"
        31⤵
        
        PID:4812
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        
        C:\Windows\Vss\Writers\Application\TextInputHost.exe
        32⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\347b5683-f2ea-4e48-bbb1-3dfe3d015e45.vbs"
        33⤵
        
        PID:3800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2306f5a-b2e8-46f7-8cb4-f02331ef281f.vbs"
        33⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\tmpE891.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE891.tmp.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\tmpE891.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE891.tmp.exe"
        34⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e81f8d0-9ed7-4dc2-a6d5-fee7fcb120b0.vbs"
        31⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\tmpCAE7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCAE7.tmp.exe"
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\tmpCAE7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCAE7.tmp.exe"
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\tmpCAE7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCAE7.tmp.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\tmpCAE7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCAE7.tmp.exe"
        34⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02f664a6-ce8e-45f5-8c31-226956834c6a.vbs"
        29⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\tmp9AA0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9AA0.tmp.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\tmp9AA0.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9AA0.tmp.exe"
        30⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\feca6e83-4235-4e7f-b8a1-7b2e1678d456.vbs"
        27⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\tmp696E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp696E.tmp.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\tmp696E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp696E.tmp.exe"
        28⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5fb588e2-3a8f-4f68-a37a-62acccd23014.vbs"
        25⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\tmp3927.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3927.tmp.exe"
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\tmp3927.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3927.tmp.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\tmp3927.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3927.tmp.exe"
        27⤵
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\237bd8ae-a81e-461c-a540-b4d83bcc2246.vbs"
        23⤵
        
        PID:4576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8483ad60-bbc6-4e41-a821-da6ffe7cdca2.vbs"
        21⤵
        
        PID:3952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ef7ee87-1063-41b8-bbac-f9022554eb0f.vbs"
        19⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\tmpE598.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE598.tmp.exe"
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\tmpE598.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE598.tmp.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\tmpE598.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE598.tmp.exe"
        21⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5289ce58-6a67-48a4-95e3-bb136e5f43f5.vbs"
        17⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\tmpC9E3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC9E3.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\tmpC9E3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC9E3.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eba2c32a-23ba-46ce-8175-9bb72a0b5fde.vbs"
        15⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\tmp9A28.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9A28.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\tmp9A28.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9A28.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d0583ad-8046-4bac-b645-6ba1a6e3cb62.vbs"
        13⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\tmp7BF1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7BF1.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\tmp7BF1.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp7BF1.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42e1e7e1-38ac-4f34-8656-1e8ef82be007.vbs"
        11⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\tmp5F80.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5F80.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\tmp5F80.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5F80.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c11539f-f6c2-4978-a95b-1b2d04ad30a7.vbs"
        9⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\tmp439C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp439C.tmp.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\tmp439C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp439C.tmp.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\tmp439C.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp439C.tmp.exe"
        11⤵
        Executes dropped EXE
        
        PID:3688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29760d1b-2dc1-4ab7-8042-a6b99b27e4f0.vbs"
        7⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\tmp2769.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2769.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\tmp2769.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2769.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:2264
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6a58134-f7cf-4354-b2c7-a8952aea9eb9.vbs"
        5⤵
        
        PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\tmpAD8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAD8.tmp.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\tmpAD8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAD8.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\tmpAD8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpAD8.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:4408
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23bb7db7-9f6e-43c8-9471-9a6381daa449.vbs"
    3⤵
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\tmpEA41.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpEA41.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\tmpEA41.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpEA41.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\L2Schemas\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Windows\L2Schemas\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Windows\Vss\Writers\Application\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\Application\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Windows\Vss\Writers\Application\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\dotnet\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Admin\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\taskhostw.exe

Filesize
4.9MB

MD5
583b26ac46872fddf808789e82a9f2af

SHA1
9546b2719df0b0cb760440605dc5b2cf8d7a45e5

SHA256
43918ef1e06764a3387bf6c6601fd6123edf75c58678bc47dcdbeedc7aa82f5a

SHA512
2a31ee6d45fc58c8162d62add81a7c53282e33034cfd5eadcc0b5db7e12003aad7575a4c9683ad3384fc18e44224e331ad5b7b2ac0365841d0b0176e37a0e78f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TextInputHost.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\144459db-b76f-4a7d-b4ea-8ab802f720d5.vbs

Filesize
728B

MD5
3951d19477f15b809d34bb718abdb06d

SHA1
76cb6407c09ec66d7d53f622338693a40a4bedde

SHA256
296dfebccda93ff921683fd05aebfa1d494fce3f04acd3e14dc781b11011ae83

SHA512
08917f9aca5334d604258d21418c15c8733972af6b57bd7681fd61a467cb5e78d597c5945d8927ab379820883fb2f72cf497a0e93c6f562ff1a18fac27ac612c

Download Submit
C:\Users\Admin\AppData\Local\Temp\23bb7db7-9f6e-43c8-9471-9a6381daa449.vbs

Filesize
504B

MD5
6dd2d9019a4947b5ff31e1126bf7ee4a

SHA1
8c42f721160c527ba2cd282d821bbff09d66015a

SHA256
95f71fffb353482234c6ef51c24a869721d62219a3dab22f56180494d9be9e46

SHA512
73aa1a8a2d7f2330e1eeb8e1889b830e1ad2747b33addbcb61cb919cfc1b13231acbcfc6cc885ab87d51a4200034fc51ac75abad3035cfca98ae7698419faa51

Download Submit
C:\Users\Admin\AppData\Local\Temp\254aeb10-e3d9-46b0-928b-27e1421d820d.vbs

Filesize
728B

MD5
24bdbf50a333675b1da1b8095e398484

SHA1
afade82f732ddfea76eac2ef32bc0f4f1823124a

SHA256
1dbc0df46471b86ad9b00861dc4caaf5e2c346c99796210d9eba223cae1f625b

SHA512
e84dc667857e06932765d62190bb0e846ecce49f05080c07d96328de452fc1adad40b94b4504f817d67fc4198cbbaf0cd51bfb6dd9953f4955e617b00a54c582

Download Submit
C:\Users\Admin\AppData\Local\Temp\790eb66f-ccc4-4a8b-8434-0bbbe6210691.vbs

Filesize
728B

MD5
1f388f2046654dcc1f49afcc129219a7

SHA1
592489d16f9f6cc67bc55af73d10fec1c2fa5882

SHA256
ebf32f443540281df69ddb15b73ec100f7509dc67c20f4e858ff8b6eafae769d

SHA512
8505c29b7b9f13ed2807ed460018311c68c98979044b3a68d369d05ca3ebfd66e97c4fd42b065572a0035a2565bfa5d61e416de1f499835f25789f71bc62a2ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\7b78fe18-5886-4e3b-b988-a3cf5eff5bb8.vbs

Filesize
728B

MD5
b2b8862c24703d5d056cb526b7a1bf42

SHA1
07a37fca59884543bda229fa854c0d4570acd003

SHA256
3670fd51c87120584eec2aca963d9f0a30f64c9a010d455502d566490b9fed13

SHA512
0882d226d13335b539853100ab4e4350c6ebcfee548fb0414384dca0ce29929b63776e670102318f1240e12c5b32c78869037c2264343f72f9dbeb400abbaa25

Download Submit
C:\Users\Admin\AppData\Local\Temp\8bc89549-dac9-4106-9af6-62d7f0e98b51.vbs

Filesize
728B

MD5
4de8e467ccd6ccd445fce1856016553e

SHA1
7061830d180d4f206e9e05bb194fbb289ad5f886

SHA256
8b33b4ee630b8a4aea5b3722a23b48d01b3a23868dfa4b3367906063855dbdd2

SHA512
9d9632aa68ebbd3863fc4ae73bdab22bb2cbb625e526ede2c02bab37e143d233c49c5a614d0cc21937ac8afff28708037a9088d8924c8e9aa92ead9ddaa0b5a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h5wfyf0x.hud.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b1ce117a-4274-449e-b70c-1825a788dc40.vbs

Filesize
728B

MD5
4dc3365d0763432641b31d130db69098

SHA1
c9501235f971fbdad7f58075c001629e42952c90

SHA256
8290b74740825989334ea4f28bb9a86bfeff55b555e88f732f9f07baebf82694

SHA512
793cead471587b130696606bdc6901b1e564d0a5e95299cf978435b50dc29c5f5e84526de3b93905dc3221466558669cbf7109f1255a3029cc938941c757b7b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\d57eabc8-8b5c-40e9-b8ca-da82663a91bb.vbs

Filesize
728B

MD5
32fcaa382a14a8828cc67d814e16a129

SHA1
88a617995d3c064408ea97b511ec6d78874b0b2f

SHA256
d35e26bac28af98e98198b3426ccafda57b2a6fd798708f9019da189b3195f04

SHA512
5a4d6c8a044f1c92a97e6e4bb69f2bcb272a80a1586b2a7adf38d4543f62f3671aedd60033f9d67e52fbf77188a674c1f70663862466ff30382ebb9dfe4b8b47

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC47D.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Windows\Vss\Writers\Application\TextInputHost.exe

Filesize
4.9MB

MD5
6c1af082e9b864690d4bd2f47129b3eb

SHA1
9191d1a4eb05c7faf3395f25d639dc562b6226a8

SHA256
5d961b93194011ff009b954aed8665eb4a933fd354ea5f708c6144f29a57ec0f

SHA512
1e009ab4f89e3af3e6403c92a84a206179b57724c71e4ab20e0c2186e81ab3d2de4c171ef98435e9cb0ba6c8eb67af2b32726950e73ad65ab2a58e30d494a070

Download Submit
memory/2696-186-0x000001EF64420000-0x000001EF64442000-memory.dmp

Filesize
136KB

Download
memory/4428-368-0x000000001B530000-0x000000001B542000-memory.dmp

Filesize
72KB

Download
memory/4544-12-0x000000001CA80000-0x000000001CFA8000-memory.dmp

Filesize
5.2MB

Download
memory/4544-0-0x00007FFBAC563000-0x00007FFBAC565000-memory.dmp

Filesize
8KB

Download
memory/4544-18-0x000000001C6A0000-0x000000001C6AC000-memory.dmp

Filesize
48KB

Download
memory/4544-11-0x000000001C540000-0x000000001C552000-memory.dmp

Filesize
72KB

Download
memory/4544-281-0x00007FFBAC563000-0x00007FFBAC565000-memory.dmp

Filesize
8KB

Download
memory/4544-2-0x00007FFBAC560000-0x00007FFBAD021000-memory.dmp

Filesize
10.8MB

Download
memory/4544-294-0x00007FFBAC560000-0x00007FFBAD021000-memory.dmp

Filesize
10.8MB

Download
memory/4544-15-0x000000001C570000-0x000000001C57E000-memory.dmp

Filesize
56KB

Download
memory/4544-14-0x000000001C560000-0x000000001C56E000-memory.dmp

Filesize
56KB

Download
memory/4544-10-0x000000001C4E0000-0x000000001C4EA000-memory.dmp

Filesize
40KB

Download
memory/4544-16-0x000000001C580000-0x000000001C588000-memory.dmp

Filesize
32KB

Download
memory/4544-1-0x0000000000B10000-0x0000000001004000-memory.dmp

Filesize
5.0MB

Download
memory/4544-13-0x000000001C550000-0x000000001C55A000-memory.dmp

Filesize
40KB

Download
memory/4544-6-0x000000001BC90000-0x000000001BC98000-memory.dmp

Filesize
32KB

Download
memory/4544-8-0x000000001C4B0000-0x000000001C4C6000-memory.dmp

Filesize
88KB

Download
memory/4544-9-0x000000001C4D0000-0x000000001C4E0000-memory.dmp

Filesize
64KB

Download
memory/4544-7-0x000000001C4A0000-0x000000001C4B0000-memory.dmp

Filesize
64KB

Download
memory/4544-17-0x000000001C590000-0x000000001C598000-memory.dmp

Filesize
32KB

Download
memory/4544-5-0x000000001C4F0000-0x000000001C540000-memory.dmp

Filesize
320KB

Download
memory/4544-4-0x000000001C480000-0x000000001C49C000-memory.dmp

Filesize
112KB

Download
memory/4544-3-0x000000001BD00000-0x000000001BE2E000-memory.dmp

Filesize
1.2MB

Download
memory/4652-292-0x0000000000700000-0x0000000000BF4000-memory.dmp

Filesize
5.0MB

Download
memory/4888-77-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download