dcrat | 54c2cddb942d1e8d23dc7cf72043f1875aed4b25047b3587ddc017cb266bfdab

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ef44e6c54801a42dc9cff0bf0459036.exe
Size

1.8MB
MD5

7ef44e6c54801a42dc9cff0bf0459036
SHA1

45322aee2375b98a8b443e08d5e9f58ac10e9e2d
SHA256

54c2cddb942d1e8d23dc7cf72043f1875aed4b25047b3587ddc017cb266bfdab
SHA512

dfdd479a802f308cc1b49886020cf420127dd87be5642d27452c3ee08198b1efbfca8358e62ed91141ed778ce3cef7ff154e0114eae27220ce81d6cd1acb5250
SSDEEP

49152:ZWqKKPZ1snfJ+rqDPuQDLME5MT4rDQNpfh:DKKZ1sRD2Q3N5MT4r

Score

10^/10

dcrat discovery evasion execution infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	516	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2936	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	2936	schtasks.exe	82

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7ef44e6c54801a42dc9cff0bf0459036.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7ef44e6c54801a42dc9cff0bf0459036.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7ef44e6c54801a42dc9cff0bf0459036.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2708-1-0x00000000005C0000-0x000000000078C000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b87-32.dat	dcrat
behavioral2/files/0x000b000000023b84-118.dat	dcrat
behavioral2/files/0x000c000000023b87-129.dat	dcrat
behavioral2/files/0x000e000000023b8a-152.dat	dcrat
behavioral2/files/0x000c000000023b90-164.dat	dcrat
behavioral2/files/0x000c000000023b92-175.dat	dcrat
behavioral2/files/0x000a000000023bbb-234.dat	dcrat
behavioral2/memory/4660-472-0x0000000000FA0000-0x000000000116C000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2092	powershell.exe
2556	powershell.exe
1996	powershell.exe
5072	powershell.exe
3544	powershell.exe
2628	powershell.exe
3088	powershell.exe
4648	powershell.exe
452	powershell.exe
3952	powershell.exe
2592	powershell.exe
3324	powershell.exe
4620	powershell.exe
512	powershell.exe
4020	powershell.exe
536	powershell.exe
1096	powershell.exe
4260	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	7ef44e6c54801a42dc9cff0bf0459036.exe

Executes dropped EXE 1 IoCs

pid	Process
4660	RuntimeBroker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7ef44e6c54801a42dc9cff0bf0459036.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7ef44e6c54801a42dc9cff0bf0459036.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\csrss.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\uk-UA\RCXA7CD.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files (x86)\Windows Mail\unsecapp.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Windows Media Player\dwm.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Windows NT\Accessories\uk-UA\6cb0b6c459d5d3	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX8223.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX9068.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\RCX92FA.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX957D.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Crashpad\RCX99F4.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Uninstall Information\RuntimeBroker.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\lsass.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Windows NT\Accessories\uk-UA\dwm.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCXA5B7.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\RuntimeBroker.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Windows Media Player\6cb0b6c459d5d3	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Crashpad\886983d96e3d3e	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\RCX8447.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\unsecapp.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows Media Player\dwm.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files (x86)\Windows Mail\29c1c3cc0f7685	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Windows Photo Viewer\System.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\6203df4a6bafc7	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\RCX84B6.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\RuntimeBroker.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Crashpad\RCX99F5.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCXA5B6.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\uk-UA\dwm.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\9e8d7a4ca61bd9	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Windows Photo Viewer\27d1bcfc3c54e0	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Crashpad\csrss.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX8203.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\RCX927C.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX94FF.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Program Files\Uninstall Information\9e8d7a4ca61bd9	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Uninstall Information\RuntimeBroker.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\System.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\lsass.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\uk-UA\RCXA7CC.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX9067.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\RuntimeBroker.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Windows\Resources\Themes\dllhost.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\RCX8E62.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\RuntimeBroker.exe	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Windows\Resources\Themes\RCX9781.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Windows\Microsoft.NET\assembly\9e8d7a4ca61bd9	7ef44e6c54801a42dc9cff0bf0459036.exe
File created	C:\Windows\Resources\Themes\5940a34987c991	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\RCX8DE4.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Windows\Resources\Themes\RCX97F0.tmp	7ef44e6c54801a42dc9cff0bf0459036.exe
File opened for modification	C:\Windows\Resources\Themes\dllhost.exe	7ef44e6c54801a42dc9cff0bf0459036.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	7ef44e6c54801a42dc9cff0bf0459036.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4564	schtasks.exe
2800	schtasks.exe
4884	schtasks.exe
2648	schtasks.exe
2352	schtasks.exe
1924	schtasks.exe
1184	schtasks.exe
4968	schtasks.exe
2196	schtasks.exe
4020	schtasks.exe
2628	schtasks.exe
3124	schtasks.exe
1008	schtasks.exe
4352	schtasks.exe
2212	schtasks.exe
1148	schtasks.exe
2632	schtasks.exe
668	schtasks.exe
4620	schtasks.exe
3952	schtasks.exe
3136	schtasks.exe
536	schtasks.exe
3148	schtasks.exe
1552	schtasks.exe
3188	schtasks.exe
4728	schtasks.exe
5024	schtasks.exe
2332	schtasks.exe
2092	schtasks.exe
1996	schtasks.exe
628	schtasks.exe
1080	schtasks.exe
1240	schtasks.exe
468	schtasks.exe
516	schtasks.exe
1196	schtasks.exe
4188	schtasks.exe
1852	schtasks.exe
3732	schtasks.exe
4616	schtasks.exe
4116	schtasks.exe
3904	schtasks.exe
3288	schtasks.exe
3324	schtasks.exe
4916	schtasks.exe
1244	schtasks.exe
3496	schtasks.exe
3836	schtasks.exe
3724	schtasks.exe
2640	schtasks.exe
2560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
2708	7ef44e6c54801a42dc9cff0bf0459036.exe
512	powershell.exe
512	powershell.exe
536	powershell.exe
536	powershell.exe
4260	powershell.exe
4260	powershell.exe
3324	powershell.exe
3324	powershell.exe
5072	powershell.exe
5072	powershell.exe
4020	powershell.exe
4020	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4660	RuntimeBroker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	7ef44e6c54801a42dc9cff0bf0459036.exe
Token: SeDebugPrivilege	512	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	4020	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	4660	RuntimeBroker.exe
Token: SeBackupPrivilege	4296	vssvc.exe
Token: SeRestorePrivilege	4296	vssvc.exe
Token: SeAuditPrivilege	4296	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 452	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	137
PID 2708 wrote to memory of 452	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	137
PID 2708 wrote to memory of 4020	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	138
PID 2708 wrote to memory of 4020	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	138
PID 2708 wrote to memory of 1096	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	139
PID 2708 wrote to memory of 1096	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	139
PID 2708 wrote to memory of 4648	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	140
PID 2708 wrote to memory of 4648	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	140
PID 2708 wrote to memory of 536	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	141
PID 2708 wrote to memory of 536	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	141
PID 2708 wrote to memory of 512	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	142
PID 2708 wrote to memory of 512	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	142
PID 2708 wrote to memory of 4620	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	143
PID 2708 wrote to memory of 4620	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	143
PID 2708 wrote to memory of 3088	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	144
PID 2708 wrote to memory of 3088	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	144
PID 2708 wrote to memory of 3324	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	145
PID 2708 wrote to memory of 3324	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	145
PID 2708 wrote to memory of 2556	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	146
PID 2708 wrote to memory of 2556	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	146
PID 2708 wrote to memory of 2592	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	147
PID 2708 wrote to memory of 2592	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	147
PID 2708 wrote to memory of 2628	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	148
PID 2708 wrote to memory of 2628	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	148
PID 2708 wrote to memory of 4260	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	149
PID 2708 wrote to memory of 4260	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	149
PID 2708 wrote to memory of 5072	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	150
PID 2708 wrote to memory of 5072	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	150
PID 2708 wrote to memory of 3952	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	151
PID 2708 wrote to memory of 3952	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	151
PID 2708 wrote to memory of 2092	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	153
PID 2708 wrote to memory of 2092	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	153
PID 2708 wrote to memory of 3544	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	154
PID 2708 wrote to memory of 3544	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	154
PID 2708 wrote to memory of 1996	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	155
PID 2708 wrote to memory of 1996	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	155
PID 2708 wrote to memory of 4348	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	173
PID 2708 wrote to memory of 4348	2708	7ef44e6c54801a42dc9cff0bf0459036.exe	173
PID 4348 wrote to memory of 5412	4348	cmd.exe	175
PID 4348 wrote to memory of 5412	4348	cmd.exe	175
PID 4348 wrote to memory of 4660	4348	cmd.exe	179
PID 4348 wrote to memory of 4660	4348	cmd.exe	179
PID 4660 wrote to memory of 5172	4660	RuntimeBroker.exe	180
PID 4660 wrote to memory of 5172	4660	RuntimeBroker.exe	180
PID 4660 wrote to memory of 5156	4660	RuntimeBroker.exe	181
PID 4660 wrote to memory of 5156	4660	RuntimeBroker.exe	181
PID 4660 wrote to memory of 4412	4660	RuntimeBroker.exe	187
PID 4660 wrote to memory of 4412	4660	RuntimeBroker.exe	187
PID 4412 wrote to memory of 5584	4412	msedge.exe	188
PID 4412 wrote to memory of 5584	4412	msedge.exe	188
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189
PID 4412 wrote to memory of 2716	4412	msedge.exe	189

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7ef44e6c54801a42dc9cff0bf0459036.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7ef44e6c54801a42dc9cff0bf0459036.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7ef44e6c54801a42dc9cff0bf0459036.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\7ef44e6c54801a42dc9cff0bf0459036.exe
"C:\Users\Admin\AppData\Local\Temp\7ef44e6c54801a42dc9cff0bf0459036.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7ef44e6c54801a42dc9cff0bf0459036.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Start Menu\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\assembly\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\MusNotification.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\uk-UA\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RGAHc2wlhM.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5412
- - C:\Windows\Microsoft.NET\assembly\RuntimeBroker.exe
    "C:\Windows\Microsoft.NET\assembly\RuntimeBroker.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4660
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3f54c0fd-fc36-4293-8ddb-d0b98669f37a.vbs"
      4⤵
      PID:5172
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa561f1b-55c9-41b2-af0b-6d2329fcc918.vbs"
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:13252/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa45ee46f8,0x7ffa45ee4708,0x7ffa45ee4718
        5⤵
        
        PID:5584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
        5⤵
        
        PID:2716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
        5⤵
        
        PID:4292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
        5⤵
        
        PID:5720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        5⤵
        
        PID:5984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
        5⤵
        
        PID:3188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
        5⤵
        
        PID:2412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
        5⤵
        
        PID:1304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
        5⤵
        
        PID:2228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
        5⤵
        
        PID:4372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
        5⤵
        
        PID:5340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
        5⤵
        
        PID:216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
        5⤵
        
        PID:1088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1
        5⤵
        
        PID:5932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5427036239007821202,16379133005053445098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1
        5⤵
        
        PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Downloads\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Downloads\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Start Menu\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Start Menu\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\assembly\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\assembly\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Microsoft.NET\assembly\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\Resources\Themes\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\Resources\Themes\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Crashpad\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Crashpad\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Crashpad\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Users\All Users\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Default\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\uk-UA\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\uk-UA\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\Accessories\uk-UA\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Media Player\dwm.exe

Filesize
1.8MB

MD5
d37af6bef1520de4a996d4e501c29cef

SHA1
26767c1ffdef9097d8db568652c7253430cab770

SHA256
fa49e2aa0721ec7b5b5ad401e7f31726c12727527434bca73ef89ccf8f69f809

SHA512
a0c33c0a0fc76524d6a2beb88485622839c67cb04aceb38997e02c05c950bad74f2b680b4c952aacf0cb2225ec24d804bb000b49c3cf13432e10334edc48d135

Download Submit
C:\Program Files\Windows Photo Viewer\System.exe

Filesize
1.8MB

MD5
a1b171deaddc49269d1e3a786cc89028

SHA1
c7fb8093b09babf3b70db9b5cdac82f9c41a607e

SHA256
7f1ada2e92183ad8b6e9e5962fea8664c2fa340b78749166b2bfefd3d4191d88

SHA512
0b40333b5cb8b7186c7233ca4f5521b12f7cb09f011d9a072fa403c74fbb80f0176c633c23b24a08f21ecfa2f89579d29df83aece0b6bf322687d19b16c977e6

Download Submit
C:\Recovery\WindowsRE\System.exe

Filesize
1.8MB

MD5
15b2d69222a08f18877ea9265434f609

SHA1
754355e0991b5c393afbc71031289b409dfed671

SHA256
020cc3b40a3fefc5f75cc7f407a39de088a7e634707df62b79a9d0f88670c660

SHA512
f4a2e0efc6fabdd0c451f4ca466c9d4213884b88f98f46df1b335b0391978d89126fc0209731de694b39fd5814bbb22994138475c91d777c828c5a365eac10f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8927791d048b581ada96f53903c7fdc1

SHA1
6f2cb5744a9c947426de6e8b2ba2ccfd5147deb9

SHA256
934f24928cd5942b51ce4719ddf2bcb2d7bf3788049b774b27f35fbe31f4791c

SHA512
fe10f3a7562285b8c855f9bccd3e780c2d4782f829b0ecb0c575e04cd576307e252203424cbc3294c902a107c04921fc511a4d14fe3a188314f904c81b449aef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5441ffccf5fd21b4e7e887a0a63abb0a

SHA1
df51e63604af0533412fd077db979255128525d5

SHA256
666b48fec4b653995ada63b420cc859b68a11359010ca921b09e2c2e0505bafc

SHA512
125e8b4e81b942bfe8c41989d756c668ccc0cf371c4adf95347ce685f08483d358f23996e3684f1f485b39c21611d1d3205553872ed261cdd042c284778a1a42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0891695562dc5cf4162eb397e9a7675b

SHA1
68102a239a9c07a4c59ce0af39005500a0534e4e

SHA256
c2f76f761b2e3474178ed1464085711ae8acc55cd4590e28a0b26cfafeec1230

SHA512
a83e7a295ebd8387d7fa285575f39e436981a108c23e58485a5d208c94a0749d2798328ae7dce1a8b44e4c60d04ee6332d1d2814e53d674585df7b8e5ae93232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5c8b0fe3f7b881485fde2cca4a2aa54b

SHA1
831104481f2e40991a50995e7d4832fbfef92b91

SHA256
d5ba8ee4a74016d184fb0502b38bd310314aa356374188466cbba91c5731d599

SHA512
8f8099e53b05961fc1d0c32d22adc8c34d486a8809f3bb4c41f828cc16c7cc1f879ee449c4c7e615c7861b7756af7e4692409da1567eb65af18ea0687a649b07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\3f54c0fd-fc36-4293-8ddb-d0b98669f37a.vbs

Filesize
727B

MD5
b2444bb726f4bd98d477b31a86dc106e

SHA1
92d8b0ce6b3e8acb6a4bb0725e1e628363923f05

SHA256
22bf557a617ec4e119e30caf15e7ea1b9d33f60a90abf0c528e8410a5f641abb

SHA512
2dbab5cdcb15d14a7d82443c5f50191e4250c5d723ada7a4ed4e47ef3c3ac1c63d7bff221296658e60bf967b97734ca404543837180d79267a527ab5107a99d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RGAHc2wlhM.bat

Filesize
216B

MD5
2dbe484166a45136ab4152f8fd38af01

SHA1
758a7bea75205d06cdc54b0e8411b958854d463f

SHA256
aa5ec7df22beb340f13d863d5a19e2a6f6277ff01efca29e7adbc6625df5a537

SHA512
babd886f3b3aeec6b0a0bfb0485315e314d2488530abf5b75d329c32d8799d18f552fbea41244d9fbff5147fa905fbf604588f34a019287238f7ea3da269a372

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ms0iunsq.ijb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fa561f1b-55c9-41b2-af0b-6d2329fcc918.vbs

Filesize
503B

MD5
979582957566f18bed9515a421b7d735

SHA1
929d8f8bfa8123819f05e6a13a6fc8a2b4746f2d

SHA256
297d1e39024c17527693092470b14a0028040f5d177ad33a9103d749897c7d85

SHA512
9fe227d534840103f3b4738a7146bf4cde26c5203f1d42dce8983e0db5d24978657a7a9bc8e51a0b1e8f27f68d3696f23bbe8d3a864082b7427ce636256fccea

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Idle.exe

Filesize
1.8MB

MD5
7ef44e6c54801a42dc9cff0bf0459036

SHA1
45322aee2375b98a8b443e08d5e9f58ac10e9e2d

SHA256
54c2cddb942d1e8d23dc7cf72043f1875aed4b25047b3587ddc017cb266bfdab

SHA512
dfdd479a802f308cc1b49886020cf420127dd87be5642d27452c3ee08198b1efbfca8358e62ed91141ed778ce3cef7ff154e0114eae27220ce81d6cd1acb5250

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Idle.exe

Filesize
1.8MB

MD5
c035635fc3aa12055418dd638fad2dd7

SHA1
8d28a69866f39ea2abd4400233446ec9107f8898

SHA256
f01c7b50068a127ad9411d9f788f75aeb42ee796665da35e3b3330fc3287d8fd

SHA512
ed6eb59a9b2fa2fc36432ad173489074ca08af17880c266c6857c4e7dacfbddf11fd72399cdb6bdfd3afaefddde0b4a0b546d2ab65d6b93bbeefd2a7ac4242ce

Download Submit
C:\Windows\Microsoft.NET\assembly\RuntimeBroker.exe

Filesize
1.8MB

MD5
164f9eb187d3c04b2b7e8be9eaf493f6

SHA1
8e43efa8029b2b523d41ccf74e235ea02228e53e

SHA256
4c63b0522f84b85a4ad053b2d3f9b35e19c5ac99f15960fdceb1de799dbe396d

SHA512
f81622a8add36a29ad3fcde3fde87c9ceb94e03f560066be02330282ddfb28a6b8301b18ec48da39f534b374fff950978792babda6a3f06436deb8c7f8455b04

Download Submit
C:\Windows\Resources\Themes\dllhost.exe

Filesize
1.8MB

MD5
dd917df651a60cc3a93799f2b65cb523

SHA1
31967838b9fe6e8100ba1c7ce70ab4963baa2052

SHA256
bfa868fe4b13ee033c44b666eafb5951638e81688495269d351e28e591027058

SHA512
0c9e1e220420b9155c17cf47a23bfacc0a9ea009d31e4bd10dbb708e7ff4c741703f8069b8ea19a36ffe3e66051872a4c24c645eb30a4271c1477cde74e17428

Download Submit
memory/512-274-0x00000174D4EC0000-0x00000174D4EE2000-memory.dmp

Filesize
136KB

Download
memory/2708-15-0x000000001BBB0000-0x000000001BBB8000-memory.dmp

Filesize
32KB

Download
memory/2708-0-0x00007FFA4CE53000-0x00007FFA4CE55000-memory.dmp

Filesize
8KB

Download
memory/2708-14-0x000000001BAA0000-0x000000001BAAC000-memory.dmp

Filesize
48KB

Download
memory/2708-18-0x000000001BD20000-0x000000001BD2E000-memory.dmp

Filesize
56KB

Download
memory/2708-13-0x000000001BA90000-0x000000001BA9C000-memory.dmp

Filesize
48KB

Download
memory/2708-178-0x00007FFA4CE50000-0x00007FFA4D911000-memory.dmp

Filesize
10.8MB

Download
memory/2708-225-0x00007FFA4CE50000-0x00007FFA4D911000-memory.dmp

Filesize
10.8MB

Download
memory/2708-21-0x000000001BD50000-0x000000001BD5C000-memory.dmp

Filesize
48KB

Download
memory/2708-267-0x00007FFA4CE50000-0x00007FFA4D911000-memory.dmp

Filesize
10.8MB

Download
memory/2708-22-0x00007FFA4CE50000-0x00007FFA4D911000-memory.dmp

Filesize
10.8MB

Download
memory/2708-19-0x000000001BD30000-0x000000001BD38000-memory.dmp

Filesize
32KB

Download
memory/2708-12-0x000000001BA80000-0x000000001BA8C000-memory.dmp

Filesize
48KB

Download
memory/2708-16-0x000000001BBC0000-0x000000001BBCC000-memory.dmp

Filesize
48KB

Download
memory/2708-25-0x00007FFA4CE50000-0x00007FFA4D911000-memory.dmp

Filesize
10.8MB

Download
memory/2708-155-0x00007FFA4CE53000-0x00007FFA4CE55000-memory.dmp

Filesize
8KB

Download
memory/2708-17-0x000000001BBD0000-0x000000001BBDA000-memory.dmp

Filesize
40KB

Download
memory/2708-20-0x000000001BD40000-0x000000001BD4C000-memory.dmp

Filesize
48KB

Download
memory/2708-11-0x000000001BA70000-0x000000001BA7C000-memory.dmp

Filesize
48KB

Download
memory/2708-10-0x000000001BA10000-0x000000001BA1C000-memory.dmp

Filesize
48KB

Download
memory/2708-1-0x00000000005C0000-0x000000000078C000-memory.dmp

Filesize
1.8MB

Download
memory/2708-9-0x000000001BA00000-0x000000001BA0A000-memory.dmp

Filesize
40KB

Download
memory/2708-8-0x000000001B9F0000-0x000000001B9F8000-memory.dmp

Filesize
32KB

Download
memory/2708-7-0x000000001B9D0000-0x000000001B9E6000-memory.dmp

Filesize
88KB

Download
memory/2708-5-0x000000001B250000-0x000000001B258000-memory.dmp

Filesize
32KB

Download
memory/2708-6-0x000000001B260000-0x000000001B270000-memory.dmp

Filesize
64KB

Download
memory/2708-4-0x000000001BA20000-0x000000001BA70000-memory.dmp

Filesize
320KB

Download
memory/2708-3-0x0000000002800000-0x000000000281C000-memory.dmp

Filesize
112KB

Download
memory/2708-2-0x00007FFA4CE50000-0x00007FFA4D911000-memory.dmp

Filesize
10.8MB

Download
memory/4660-472-0x0000000000FA0000-0x000000000116C000-memory.dmp

Filesize
1.8MB

Download