Analysis
-
max time kernel
88s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2024 19:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
120 seconds
General
-
Target
756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe
-
Size
4.9MB
-
MD5
1bb1f6509357d3d40ecab459efc44290
-
SHA1
61f543cf1d45c98cc1e9042136537596ff94ed81
-
SHA256
756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1
-
SHA512
0cddafaf5705ab544213bec159df6a70aa9e9bc6cef020f2cbb9a24bb40d21ea6220ecbfa49540ae114be0ef3845324c8687927dee594b818b150980fd0c9be7
-
SSDEEP
49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
Family
colibri
Version
1.2.0
Botnet
Build1
C2
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain
Signatures
-
Colibri family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 42 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1424 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3680 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5012 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1388 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3284 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2356 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3064 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1764 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4980 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3956 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4564 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5108 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3056 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2872 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1644 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 684 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4520 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4560 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1788 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1228 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1312 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4100 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4548 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4160 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1504 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4216 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2680 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 716 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4016 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2884 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3264 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1756 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2368 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3508 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5096 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1336 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4012 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3260 1092 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3236 1092 schtasks.exe 85 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found -
resource yara_rule behavioral2/memory/4808-3-0x000000001BCA0000-0x000000001BDCE000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 964 powershell.exe 1640 powershell.exe 4756 powershell.exe 5012 powershell.exe 4796 powershell.exe 1424 powershell.exe 2904 powershell.exe 3680 powershell.exe 4976 powershell.exe 4448 powershell.exe 1600 powershell.exe -
Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Process not Found -
Executes dropped EXE 64 IoCs
pid Process 1184 tmp8158.tmp.exe 1488 tmp8158.tmp.exe 744 tmp8158.tmp.exe 64 RuntimeBroker.exe 4364 tmpACBB.tmp.exe 2404 tmpACBB.tmp.exe 228 RuntimeBroker.exe 4460 tmpE09C.tmp.exe 912 tmpE09C.tmp.exe 4520 tmpE09C.tmp.exe 4172 tmpE09C.tmp.exe 1216 tmpE09C.tmp.exe 3708 tmpE09C.tmp.exe 4976 tmpE09C.tmp.exe 2876 tmpE09C.tmp.exe 4892 tmpE09C.tmp.exe 3772 tmpE09C.tmp.exe 3520 tmpE09C.tmp.exe 1484 tmpE09C.tmp.exe 1420 tmpE09C.tmp.exe 3580 tmpE09C.tmp.exe 4584 tmpE09C.tmp.exe 3076 tmpE09C.tmp.exe 4344 tmpE09C.tmp.exe 3720 tmpE09C.tmp.exe 2280 tmpE09C.tmp.exe 2956 tmpE09C.tmp.exe 3664 tmpE09C.tmp.exe 5068 tmpE09C.tmp.exe 2532 tmpE09C.tmp.exe 3696 tmpE09C.tmp.exe 4792 tmpE09C.tmp.exe 3344 tmpE09C.tmp.exe 4256 tmpE09C.tmp.exe 2724 tmpE09C.tmp.exe 2464 tmpE09C.tmp.exe 5080 tmpE09C.tmp.exe 4684 tmpE09C.tmp.exe 4208 tmpE09C.tmp.exe 3912 tmpE09C.tmp.exe 1804 tmpE09C.tmp.exe 4912 tmpE09C.tmp.exe 3316 tmpE09C.tmp.exe 668 tmpE09C.tmp.exe 3988 tmpE09C.tmp.exe 4232 tmpE09C.tmp.exe 1864 tmpE09C.tmp.exe 2900 tmpE09C.tmp.exe 5104 tmpE09C.tmp.exe 4252 tmpE09C.tmp.exe 4048 tmpE09C.tmp.exe 4128 tmpE09C.tmp.exe 1996 tmpE09C.tmp.exe 932 tmpE09C.tmp.exe 2620 tmpE09C.tmp.exe 4776 tmpE09C.tmp.exe 916 tmpE09C.tmp.exe 3572 tmpE09C.tmp.exe 1216 tmpE09C.tmp.exe 3708 tmpE09C.tmp.exe 2860 tmpE09C.tmp.exe 3064 tmpE09C.tmp.exe 2244 tmpE09C.tmp.exe 2440 tmpE09C.tmp.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe -
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 1488 set thread context of 744 1488 tmp8158.tmp.exe 131 PID 4364 set thread context of 2404 4364 tmpACBB.tmp.exe 161 PID 1216 set thread context of 228 1216 tmp1047.tmp.exe 776 PID 3780 set thread context of 1032 3780 tmp2B70.tmp.exe 1380 PID 4208 set thread context of 684 4208 Process not Found 2619 PID 932 set thread context of 2620 932 Process not Found 3298 PID 4144 set thread context of 4364 4144 Process not Found 3993 PID 2856 set thread context of 4252 2856 Process not Found 4476 -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Services\lsass.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Program Files\Windows NT\Accessories\es-ES\RuntimeBroker.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Program Files (x86)\Windows Defender\it-IT\unsecapp.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Program Files\Common Files\Services\RCX97C9.tmp 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Program Files (x86)\Google\Temp\RCX8D63.tmp 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Program Files (x86)\Google\Temp\unsecapp.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Program Files\Internet Explorer\fr-FR\OfficeClickToRun.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Program Files (x86)\Windows Defender\it-IT\29c1c3cc0f7685 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Program Files\Internet Explorer\fr-FR\e6c9b481da804f 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Program Files\Common Files\Services\lsass.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Program Files (x86)\Google\Temp\unsecapp.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\RCX919B.tmp 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\OfficeClickToRun.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Program Files\Windows NT\Accessories\es-ES\RuntimeBroker.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Program Files\Windows NT\Accessories\es-ES\9e8d7a4ca61bd9 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Program Files (x86)\Google\Temp\29c1c3cc0f7685 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Program Files (x86)\Windows Defender\it-IT\RCX95B4.tmp 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Program Files (x86)\Windows Defender\it-IT\unsecapp.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Program Files\Common Files\Services\6203df4a6bafc7 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Program Files\Windows NT\Accessories\es-ES\RCX7DDC.tmp 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\uk-UA\RuntimeBroker.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Windows\ModemLogs\SppExtComObj.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Windows\ModemLogs\e1ef82546f0b02 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Windows\uk-UA\RuntimeBroker.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File created C:\Windows\uk-UA\9e8d7a4ca61bd9 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Windows\ModemLogs\RCX865C.tmp 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Windows\ModemLogs\SppExtComObj.exe 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe File opened for modification C:\Windows\uk-UA\RCX99CD.tmp 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE09C.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings Process not Found -
Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4160 schtasks.exe 1504 schtasks.exe 4100 schtasks.exe 1312 schtasks.exe 5096 schtasks.exe 3260 schtasks.exe 2356 schtasks.exe 5108 schtasks.exe 4016 schtasks.exe 3264 schtasks.exe 1764 schtasks.exe 3056 schtasks.exe 1644 schtasks.exe 4216 schtasks.exe 716 schtasks.exe 3508 schtasks.exe 1336 schtasks.exe 4980 schtasks.exe 3064 schtasks.exe 2428 schtasks.exe 4520 schtasks.exe 1788 schtasks.exe 2680 schtasks.exe 2368 schtasks.exe 3284 schtasks.exe 3956 schtasks.exe 1704 schtasks.exe 684 schtasks.exe 4548 schtasks.exe 4012 schtasks.exe 1388 schtasks.exe 3680 schtasks.exe 4564 schtasks.exe 4560 schtasks.exe 1228 schtasks.exe 4460 schtasks.exe 3236 schtasks.exe 1424 schtasks.exe 2872 schtasks.exe 2884 schtasks.exe 1756 schtasks.exe 5012 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 4448 powershell.exe 4448 powershell.exe 1600 powershell.exe 1600 powershell.exe 3680 powershell.exe 3680 powershell.exe 1424 powershell.exe 1424 powershell.exe 1640 powershell.exe 1640 powershell.exe 2904 powershell.exe 2904 powershell.exe 964 powershell.exe 964 powershell.exe 4976 powershell.exe 4976 powershell.exe 4796 powershell.exe 4796 powershell.exe 5012 powershell.exe 5012 powershell.exe 4756 powershell.exe 4756 powershell.exe 5012 powershell.exe 4448 powershell.exe 1600 powershell.exe 3680 powershell.exe 1424 powershell.exe 1640 powershell.exe 2904 powershell.exe 964 powershell.exe 4976 powershell.exe 4796 powershell.exe 4756 powershell.exe 64 RuntimeBroker.exe 64 RuntimeBroker.exe 228 RuntimeBroker.exe 4904 RuntimeBroker.exe 1532 RuntimeBroker.exe 1860 Process not Found 1576 Process not Found 4084 Process not Found 5032 Process not Found -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe Token: SeDebugPrivilege 4448 powershell.exe Token: SeDebugPrivilege 1600 powershell.exe Token: SeDebugPrivilege 3680 powershell.exe Token: SeDebugPrivilege 1424 powershell.exe Token: SeDebugPrivilege 1640 powershell.exe Token: SeDebugPrivilege 2904 powershell.exe Token: SeDebugPrivilege 4976 powershell.exe Token: SeDebugPrivilege 964 powershell.exe Token: SeDebugPrivilege 4796 powershell.exe Token: SeDebugPrivilege 5012 powershell.exe Token: SeDebugPrivilege 4756 powershell.exe Token: SeDebugPrivilege 64 RuntimeBroker.exe Token: SeDebugPrivilege 228 RuntimeBroker.exe Token: SeDebugPrivilege 4904 RuntimeBroker.exe Token: SeDebugPrivilege 1532 RuntimeBroker.exe Token: SeDebugPrivilege 1860 Process not Found Token: SeDebugPrivilege 1576 Process not Found Token: SeDebugPrivilege 4084 Process not Found Token: SeDebugPrivilege 5032 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4808 wrote to memory of 1184 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 128 PID 4808 wrote to memory of 1184 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 128 PID 4808 wrote to memory of 1184 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 128 PID 1184 wrote to memory of 1488 1184 tmp8158.tmp.exe 130 PID 1184 wrote to memory of 1488 1184 tmp8158.tmp.exe 130 PID 1184 wrote to memory of 1488 1184 tmp8158.tmp.exe 130 PID 1488 wrote to memory of 744 1488 tmp8158.tmp.exe 131 PID 1488 wrote to memory of 744 1488 tmp8158.tmp.exe 131 PID 1488 wrote to memory of 744 1488 tmp8158.tmp.exe 131 PID 1488 wrote to memory of 744 1488 tmp8158.tmp.exe 131 PID 1488 wrote to memory of 744 1488 tmp8158.tmp.exe 131 PID 1488 wrote to memory of 744 1488 tmp8158.tmp.exe 131 PID 1488 wrote to memory of 744 1488 tmp8158.tmp.exe 131 PID 4808 wrote to memory of 4756 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 133 PID 4808 wrote to memory of 4756 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 133 PID 4808 wrote to memory of 1600 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 134 PID 4808 wrote to memory of 1600 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 134 PID 4808 wrote to memory of 1640 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 135 PID 4808 wrote to memory of 1640 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 135 PID 4808 wrote to memory of 964 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 136 PID 4808 wrote to memory of 964 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 136 PID 4808 wrote to memory of 2904 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 137 PID 4808 wrote to memory of 2904 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 137 PID 4808 wrote to memory of 1424 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 138 PID 4808 wrote to memory of 1424 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 138 PID 4808 wrote to memory of 4448 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 139 PID 4808 wrote to memory of 4448 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 139 PID 4808 wrote to memory of 4796 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 140 PID 4808 wrote to memory of 4796 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 140 PID 4808 wrote to memory of 5012 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 141 PID 4808 wrote to memory of 5012 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 141 PID 4808 wrote to memory of 4976 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 142 PID 4808 wrote to memory of 4976 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 142 PID 4808 wrote to memory of 3680 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 143 PID 4808 wrote to memory of 3680 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 143 PID 4808 wrote to memory of 64 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 155 PID 4808 wrote to memory of 64 4808 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe 155 PID 64 wrote to memory of 4788 64 RuntimeBroker.exe 157 PID 64 wrote to memory of 4788 64 RuntimeBroker.exe 157 PID 64 wrote to memory of 5052 64 RuntimeBroker.exe 158 PID 64 wrote to memory of 5052 64 RuntimeBroker.exe 158 PID 64 wrote to memory of 4364 64 RuntimeBroker.exe 159 PID 64 wrote to memory of 4364 64 RuntimeBroker.exe 159 PID 64 wrote to memory of 4364 64 RuntimeBroker.exe 159 PID 4364 wrote to memory of 2404 4364 tmpACBB.tmp.exe 161 PID 4364 wrote to memory of 2404 4364 tmpACBB.tmp.exe 161 PID 4364 wrote to memory of 2404 4364 tmpACBB.tmp.exe 161 PID 4364 wrote to memory of 2404 4364 tmpACBB.tmp.exe 161 PID 4364 wrote to memory of 2404 4364 tmpACBB.tmp.exe 161 PID 4364 wrote to memory of 2404 4364 tmpACBB.tmp.exe 161 PID 4364 wrote to memory of 2404 4364 tmpACBB.tmp.exe 161 PID 4788 wrote to memory of 228 4788 WScript.exe 173 PID 4788 wrote to memory of 228 4788 WScript.exe 173 PID 228 wrote to memory of 1648 228 RuntimeBroker.exe 175 PID 228 wrote to memory of 1648 228 RuntimeBroker.exe 175 PID 228 wrote to memory of 3104 228 RuntimeBroker.exe 176 PID 228 wrote to memory of 3104 228 RuntimeBroker.exe 176 PID 228 wrote to memory of 4460 228 RuntimeBroker.exe 177 PID 228 wrote to memory of 4460 228 RuntimeBroker.exe 177 PID 228 wrote to memory of 4460 228 RuntimeBroker.exe 177 PID 4460 wrote to memory of 912 4460 tmpE09C.tmp.exe 179 PID 4460 wrote to memory of 912 4460 tmpE09C.tmp.exe 179 PID 4460 wrote to memory of 912 4460 tmpE09C.tmp.exe 179 PID 912 wrote to memory of 4520 912 tmpE09C.tmp.exe 180 -
System policy modification 1 TTPs 27 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe"C:\Users\Admin\AppData\Local\Temp\756cbd9f6a66ab84ffb1c78f2d054b61c91797d3e85919aac35d8fbf3ef560b1N.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\tmp8158.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8158.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\tmp8158.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8158.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\tmp8158.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8158.tmp.exe"4⤵
- Executes dropped EXE
PID:744
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
-
C:\Program Files\Windows NT\Accessories\es-ES\RuntimeBroker.exe"C:\Program Files\Windows NT\Accessories\es-ES\RuntimeBroker.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:64 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3ddee5b2-8058-44f4-b822-df5721f5dc2a.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Program Files\Windows NT\Accessories\es-ES\RuntimeBroker.exe"C:\Program Files\Windows NT\Accessories\es-ES\RuntimeBroker.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:228 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68d8155f-65cd-4e43-8b8f-02424273fc74.vbs"5⤵PID:1648
-
C:\Program Files\Windows NT\Accessories\es-ES\RuntimeBroker.exe"C:\Program Files\Windows NT\Accessories\es-ES\RuntimeBroker.exe"6⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4904 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4bb5a3e-e654-479c-9822-1004cfdd357b.vbs"7⤵PID:4100
-
C:\Program Files\Windows NT\Accessories\es-ES\RuntimeBroker.exe"C:\Program Files\Windows NT\Accessories\es-ES\RuntimeBroker.exe"8⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1532 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34a37aaa-6bac-499b-a4cb-9cffc9dbd3a7.vbs"9⤵PID:436
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4fd4e361-3665-4ef6-aea7-c665543efdea.vbs"9⤵PID:3900
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2B70.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2B70.tmp.exe"9⤵
- Suspicious use of SetThreadContext
PID:3780 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵PID:3312
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2B70.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2B70.tmp.exe"10⤵PID:1032
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e758df96-fbed-4e9d-83be-78a6fbe22717.vbs"7⤵PID:3712
-
-
C:\Users\Admin\AppData\Local\Temp\tmp1047.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1047.tmp.exe"7⤵
- Suspicious use of SetThreadContext
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\tmp1047.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1047.tmp.exe"8⤵PID:228
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\940ab116-fe75-476f-acb3-af10dddf9032.vbs"5⤵PID:3104
-
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"7⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"8⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"9⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"10⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"11⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"12⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"13⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"14⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"15⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"16⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"17⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"18⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"19⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"20⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"21⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"22⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"23⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"24⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"25⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"26⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"27⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"28⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"29⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"30⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"31⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"32⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"33⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"34⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"35⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"36⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"37⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"38⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"39⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"40⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"41⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"42⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"43⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"44⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"45⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"46⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"47⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"48⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"49⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"51⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"52⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"53⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"54⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"55⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"56⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"57⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"58⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"59⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"60⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"61⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"62⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"63⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"64⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"65⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"66⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"67⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"68⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"69⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"70⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"71⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"72⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"73⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"74⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"75⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"76⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"77⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"78⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"79⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"80⤵
- System Location Discovery: System Language Discovery
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"81⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"82⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"83⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"84⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"85⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"86⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"87⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"88⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"89⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"90⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"91⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"92⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"93⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"94⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"95⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"96⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"97⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"98⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"99⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"100⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"101⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"102⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"103⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"104⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"105⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"106⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"107⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"108⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"109⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"110⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"111⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"112⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"113⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"114⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"115⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"116⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"117⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"118⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"119⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"120⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE09C.tmp.exe"121⤵PID:4848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-