colibri | eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Size

4.9MB
MD5

f954807077449b5cc1d07ed866dc8e06
SHA1

af066d14f43a45603e8de65123f8816989b392d7
SHA256

eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274
SHA512

df0cdb0771fcb063f1e539b01aae5d19c9019dc8aef972180c60682eeeb4d17f1e55198b457978f793fc8bf13e28922f9745be480132598c819ec102e6360f75
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	652	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3600	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3784	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	1168	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	1168	schtasks.exe	83

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4992-3-0x000000001B790000-0x000000001B8BE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4000	powershell.exe
4048	powershell.exe
1300	powershell.exe
1924	powershell.exe
408	powershell.exe
4872	powershell.exe
4832	powershell.exe
4624	powershell.exe
2088	powershell.exe
4756	powershell.exe
1484	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe

Executes dropped EXE 40 IoCs

pid	Process
5060	tmpB335.tmp.exe
3408	tmpB335.tmp.exe
4764	tmpB335.tmp.exe
2464	services.exe
4992	tmpEA02.tmp.exe
4880	tmpEA02.tmp.exe
3372	services.exe
2724	tmp1FD7.tmp.exe
2520	tmp1FD7.tmp.exe
1932	services.exe
3528	tmp505D.tmp.exe
4860	tmp505D.tmp.exe
2212	services.exe
4256	tmp8141.tmp.exe
1380	tmp8141.tmp.exe
4796	services.exe
1552	services.exe
3868	tmpBC08.tmp.exe
3200	tmpBC08.tmp.exe
5068	tmpBC08.tmp.exe
1972	services.exe
2520	tmpD879.tmp.exe
2072	tmpD879.tmp.exe
1908	services.exe
2316	tmpF519.tmp.exe
2512	tmpF519.tmp.exe
3344	services.exe
3628	tmp2512.tmp.exe
1444	tmp2512.tmp.exe
2104	services.exe
2160	tmp55A8.tmp.exe
4300	tmp55A8.tmp.exe
4072	services.exe
1652	tmp8553.tmp.exe
2472	tmp8553.tmp.exe
5108	services.exe
1864	services.exe
1936	tmpD2C7.tmp.exe
3984	tmpD2C7.tmp.exe
3376	services.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	services.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 3408 set thread context of 4764	3408	tmpB335.tmp.exe	138
PID 4992 set thread context of 4880	4992	tmpEA02.tmp.exe	175
PID 2724 set thread context of 2520	2724	tmp1FD7.tmp.exe	190
PID 3528 set thread context of 4860	3528	tmp505D.tmp.exe	201
PID 4256 set thread context of 1380	4256	tmp8141.tmp.exe	211
PID 3200 set thread context of 5068	3200	tmpBC08.tmp.exe	226
PID 2520 set thread context of 2072	2520	tmpD879.tmp.exe	236
PID 2316 set thread context of 2512	2316	tmpF519.tmp.exe	245
PID 3628 set thread context of 1444	3628	tmp2512.tmp.exe	254
PID 2160 set thread context of 4300	2160	tmp55A8.tmp.exe	263
PID 1652 set thread context of 2472	1652	tmp8553.tmp.exe	272
PID 1936 set thread context of 3984	1936	tmpD2C7.tmp.exe	286

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\images\SppExtComObj.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files\Mozilla Firefox\taskhostw.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files\Internet Explorer\images\e1ef82546f0b02	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files\Windows Defender\dllhost.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCXBD7B.tmp	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files\Windows Defender\RCXC3B8.tmp	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files\Windows Defender\dllhost.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files\Microsoft Office\services.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files (x86)\Google\Update\Offline\lsass.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files\Mozilla Firefox\taskhostw.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\RCXD5D0.tmp	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Offline\lsass.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\e6c9b481da804f	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\6203df4a6bafc7	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files\Internet Explorer\images\SppExtComObj.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCXCADF.tmp	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files\Mozilla Firefox\ea9f0e6c9e2dcd	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files\Microsoft Office\RCXC8BB.tmp	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files\Windows Defender\5940a34987c991	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files\Microsoft Office\c5b4cb5e9653cc	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\services.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files\Internet Explorer\images\RCXB6F0.tmp	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Program Files (x86)\Google\Update\Offline\6203df4a6bafc7	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files\Microsoft Office\services.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXCCF3.tmp	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Media\c5b4cb5e9653cc	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Windows\uk-UA\StartMenuExperienceHost.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Windows\uk-UA\55b276f4edf653	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Windows\Media\RCXB4CC.tmp	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Windows\Media\services.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Windows\uk-UA\RCXD34E.tmp	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File opened for modification	C:\Windows\uk-UA\StartMenuExperienceHost.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
File created	C:\Windows\Media\services.exe	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB335.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2512.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8141.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF519.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp55A8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB335.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpEA02.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBC08.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD879.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8553.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD2C7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1FD7.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp505D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBC08.tmp.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2436	schtasks.exe
4000	schtasks.exe
3600	schtasks.exe
4784	schtasks.exe
1448	schtasks.exe
652	schtasks.exe
5108	schtasks.exe
2288	schtasks.exe
4624	schtasks.exe
4040	schtasks.exe
1968	schtasks.exe
920	schtasks.exe
2428	schtasks.exe
1580	schtasks.exe
2968	schtasks.exe
3372	schtasks.exe
4188	schtasks.exe
1760	schtasks.exe
4052	schtasks.exe
3520	schtasks.exe
3872	schtasks.exe
4796	schtasks.exe
2208	schtasks.exe
1484	schtasks.exe
2624	schtasks.exe
4308	schtasks.exe
4032	schtasks.exe
4988	schtasks.exe
984	schtasks.exe
2092	schtasks.exe
4364	schtasks.exe
2012	schtasks.exe
2064	schtasks.exe
1728	schtasks.exe
4220	schtasks.exe
544	schtasks.exe
3784	schtasks.exe
4472	schtasks.exe
1324	schtasks.exe
3864	schtasks.exe
640	schtasks.exe
3580	schtasks.exe
2944	schtasks.exe
4060	schtasks.exe
3716	schtasks.exe
2628	schtasks.exe
2552	schtasks.exe
5068	schtasks.exe
1560	schtasks.exe
1848	schtasks.exe
1928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
1924	powershell.exe
1924	powershell.exe
4872	powershell.exe
4872	powershell.exe
408	powershell.exe
408	powershell.exe
4624	powershell.exe
4624	powershell.exe
4000	powershell.exe
4000	powershell.exe
4756	powershell.exe
4756	powershell.exe
4832	powershell.exe
4832	powershell.exe
1484	powershell.exe
1484	powershell.exe
4048	powershell.exe
4048	powershell.exe
1300	powershell.exe
1300	powershell.exe
2088	powershell.exe
2088	powershell.exe
4624	powershell.exe
4048	powershell.exe
1924	powershell.exe
408	powershell.exe
4872	powershell.exe
4756	powershell.exe
4000	powershell.exe
1484	powershell.exe
1300	powershell.exe
4832	powershell.exe
2088	powershell.exe
2464	services.exe
2464	services.exe
3372	services.exe
1932	services.exe
2212	services.exe
4796	services.exe
1552	services.exe
1972	services.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	4048	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	2464	services.exe
Token: SeDebugPrivilege	3372	services.exe
Token: SeDebugPrivilege	1932	services.exe
Token: SeDebugPrivilege	2212	services.exe
Token: SeDebugPrivilege	4796	services.exe
Token: SeDebugPrivilege	1552	services.exe
Token: SeDebugPrivilege	1972	services.exe
Token: SeDebugPrivilege	1908	services.exe
Token: SeDebugPrivilege	3344	services.exe
Token: SeDebugPrivilege	2104	services.exe
Token: SeDebugPrivilege	4072	services.exe
Token: SeDebugPrivilege	5108	services.exe
Token: SeDebugPrivilege	1864	services.exe
Token: SeDebugPrivilege	3376	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 5060	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	135
PID 4992 wrote to memory of 5060	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	135
PID 4992 wrote to memory of 5060	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	135
PID 5060 wrote to memory of 3408	5060	tmpB335.tmp.exe	137
PID 5060 wrote to memory of 3408	5060	tmpB335.tmp.exe	137
PID 5060 wrote to memory of 3408	5060	tmpB335.tmp.exe	137
PID 3408 wrote to memory of 4764	3408	tmpB335.tmp.exe	138
PID 3408 wrote to memory of 4764	3408	tmpB335.tmp.exe	138
PID 3408 wrote to memory of 4764	3408	tmpB335.tmp.exe	138
PID 3408 wrote to memory of 4764	3408	tmpB335.tmp.exe	138
PID 3408 wrote to memory of 4764	3408	tmpB335.tmp.exe	138
PID 3408 wrote to memory of 4764	3408	tmpB335.tmp.exe	138
PID 3408 wrote to memory of 4764	3408	tmpB335.tmp.exe	138
PID 4992 wrote to memory of 1300	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	145
PID 4992 wrote to memory of 1300	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	145
PID 4992 wrote to memory of 1924	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	146
PID 4992 wrote to memory of 1924	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	146
PID 4992 wrote to memory of 408	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	147
PID 4992 wrote to memory of 408	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	147
PID 4992 wrote to memory of 4872	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	148
PID 4992 wrote to memory of 4872	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	148
PID 4992 wrote to memory of 4624	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	149
PID 4992 wrote to memory of 4624	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	149
PID 4992 wrote to memory of 2088	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	150
PID 4992 wrote to memory of 2088	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	150
PID 4992 wrote to memory of 4000	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	151
PID 4992 wrote to memory of 4000	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	151
PID 4992 wrote to memory of 4048	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	152
PID 4992 wrote to memory of 4048	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	152
PID 4992 wrote to memory of 4756	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	153
PID 4992 wrote to memory of 4756	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	153
PID 4992 wrote to memory of 1484	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	154
PID 4992 wrote to memory of 1484	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	154
PID 4992 wrote to memory of 4832	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	155
PID 4992 wrote to memory of 4832	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	155
PID 4992 wrote to memory of 2464	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	167
PID 4992 wrote to memory of 2464	4992	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe	167
PID 2464 wrote to memory of 5028	2464	services.exe	171
PID 2464 wrote to memory of 5028	2464	services.exe	171
PID 2464 wrote to memory of 4772	2464	services.exe	172
PID 2464 wrote to memory of 4772	2464	services.exe	172
PID 2464 wrote to memory of 4992	2464	services.exe	173
PID 2464 wrote to memory of 4992	2464	services.exe	173
PID 2464 wrote to memory of 4992	2464	services.exe	173
PID 4992 wrote to memory of 4880	4992	tmpEA02.tmp.exe	175
PID 4992 wrote to memory of 4880	4992	tmpEA02.tmp.exe	175
PID 4992 wrote to memory of 4880	4992	tmpEA02.tmp.exe	175
PID 4992 wrote to memory of 4880	4992	tmpEA02.tmp.exe	175
PID 4992 wrote to memory of 4880	4992	tmpEA02.tmp.exe	175
PID 4992 wrote to memory of 4880	4992	tmpEA02.tmp.exe	175
PID 4992 wrote to memory of 4880	4992	tmpEA02.tmp.exe	175
PID 5028 wrote to memory of 3372	5028	WScript.exe	182
PID 5028 wrote to memory of 3372	5028	WScript.exe	182
PID 3372 wrote to memory of 2208	3372	services.exe	185
PID 3372 wrote to memory of 2208	3372	services.exe	185
PID 3372 wrote to memory of 2932	3372	services.exe	186
PID 3372 wrote to memory of 2932	3372	services.exe	186
PID 3372 wrote to memory of 2724	3372	services.exe	188
PID 3372 wrote to memory of 2724	3372	services.exe	188
PID 3372 wrote to memory of 2724	3372	services.exe	188
PID 2724 wrote to memory of 2520	2724	tmp1FD7.tmp.exe	190
PID 2724 wrote to memory of 2520	2724	tmp1FD7.tmp.exe	190
PID 2724 wrote to memory of 2520	2724	tmp1FD7.tmp.exe	190
PID 2724 wrote to memory of 2520	2724	tmp1FD7.tmp.exe	190

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	services.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe
"C:\Users\Admin\AppData\Local\Temp\eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4992
- C:\Users\Admin\AppData\Local\Temp\tmpB335.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB335.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\tmpB335.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpB335.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\tmpB335.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpB335.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:4764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- C:\Windows\Media\services.exe
  "C:\Windows\Media\services.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2464
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12a3e7f3-042a-4392-a9c9-b3e83a5ce603.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\Media\services.exe
      C:\Windows\Media\services.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3372
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7dfee452-36bb-42a3-a3eb-420b8c1246e6.vbs"
        5⤵
        
        PID:2208
      - C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6c7e4259-dbf9-42b1-bd4e-4695923adeb6.vbs"
        7⤵
        
        PID:3628
        
        C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2212
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31ae7dec-e455-4c3b-8a65-496c86dab23c.vbs"
        9⤵
        
        PID:2348
        
        C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4796
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4501f43f-e4e8-4f1d-ae33-efea269da67c.vbs"
        11⤵
        
        PID:3140
        
        C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d44166a7-4172-4e3c-a69b-464d3432b659.vbs"
        13⤵
        
        PID:652
        
        C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\506a5401-a420-4ddd-8a2d-a4cbc60cf829.vbs"
        15⤵
        
        PID:1324
        
        C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb0bdf4f-2353-43ec-bb5c-5acf7e7eb31f.vbs"
        17⤵
        
        PID:2008
        
        C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c2e554c3-ae7e-41ef-b589-6117c906c25d.vbs"
        19⤵
        
        PID:3508
        
        C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d6ebfdf-a7ca-442d-ba61-31a55d9b38d0.vbs"
        21⤵
        
        PID:2616
        
        C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4072
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2fd9547a-ab33-4bf5-b5e6-9bdf6e039332.vbs"
        23⤵
        
        PID:4368
        
        C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a827aa3-3d71-4746-98da-1d7bf668d3ad.vbs"
        25⤵
        
        PID:3304
        
        C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        26⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b49bff9-bb6e-4c8b-9be2-1e00fc0e478d.vbs"
        27⤵
        
        PID:4288
        
        C:\Windows\Media\services.exe
        
        C:\Windows\Media\services.exe
        28⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e4fe6dc-34eb-475b-9885-5c6f890e0b87.vbs"
        29⤵
        
        PID:5100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\109c04bb-9743-4b10-bad1-0fc003337ce3.vbs"
        29⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\tmpEFA6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpEFA6.tmp.exe"
        29⤵
        
        PID:3504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4bc59ad-5dd2-4ba0-b2b9-7d923e2d81a1.vbs"
        27⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\tmpD2C7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD2C7.tmp.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\tmpD2C7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD2C7.tmp.exe"
        28⤵
        Executes dropped EXE
        
        PID:3984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2579c9fc-b0b4-436f-b9c3-9f730f6f76f0.vbs"
        25⤵
        
        PID:2236
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e89be204-dd6c-4403-99c9-431fd4c34c8a.vbs"
        23⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\tmp8553.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8553.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\tmp8553.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8553.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:2472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3946098-d3c6-4302-b547-d60b5d572d26.vbs"
        21⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\tmp55A8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp55A8.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\tmp55A8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp55A8.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a86885c-dd6a-4b0e-ab79-2725ef126381.vbs"
        19⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\tmp2512.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2512.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\tmp2512.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2512.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:1444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae1173e7-70c9-4f4f-9356-ce652ad6a400.vbs"
        17⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\tmpF519.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF519.tmp.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\tmpF519.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF519.tmp.exe"
        18⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\093f9540-2ccb-40fe-a81f-83fe2c384091.vbs"
        15⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\tmpD879.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD879.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\tmpD879.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD879.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f049036c-5a79-4801-a8e7-4e489a617837.vbs"
        13⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\tmpBC08.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBC08.tmp.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\tmpBC08.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBC08.tmp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\tmpBC08.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBC08.tmp.exe"
        15⤵
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d690e180-4a8d-4b0b-9bfe-3651cc26cb8c.vbs"
        11⤵
        
        PID:3544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\09ee5d5c-142a-46c9-9ab9-553c2861bda9.vbs"
        9⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\tmp8141.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8141.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\tmp8141.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8141.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:1380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62e78004-5971-4014-b340-03a2031d1194.vbs"
        7⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\tmp505D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp505D.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\tmp505D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp505D.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:4860
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2994705f-963a-46a2-9e56-447dd5dd4dee.vbs"
        5⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\tmp1FD7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1FD7.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\tmp1FD7.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1FD7.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:2520
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eefb7da5-0b12-4b90-96af-228c6e14528d.vbs"
    3⤵
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\tmpEA02.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpEA02.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\tmpEA02.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpEA02.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Media\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\Media\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\images\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\images\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Recent\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Recent\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Recent\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\Offline\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Offline\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\Offline\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\RCXCCF3.tmp

Filesize
4.9MB

MD5
3d564b504f68424db0c581701a2e842b

SHA1
7e0d37e40ca6cd05577d50d06e90aedb359fdb7a

SHA256
52e44be828d39a0cbee06592b0d9c4baa7081e824a7f80b546f1539e76f7d201

SHA512
a39df188ab8826deb30bf224d85478705b09213a03a0d8206d5de7c63d5b85046635afda45f1d4ade4a9df78231d16aa56dd96aeff33ae3ea8dc5e7ead4bb364

Download Submit
C:\Recovery\WindowsRE\StartMenuExperienceHost.exe

Filesize
4.9MB

MD5
72b440c86e754306e90193cbdf6f45be

SHA1
4015cf8ab7cc9da9cb85f65c0007eb71152bdb1e

SHA256
ea5bee812f0f5d8f8579c762e1c8dbd37d6817585dc0217fd3aca216411c2487

SHA512
4f68ffa5e527627d561ae93a5d48fd7c5b8ca58b5b7cff0a2f14614407312d934facd7d7be4403e9fb2995f8e6756c0820bbeb195014006c4d6aafd422182778

Download Submit
C:\Recovery\WindowsRE\taskhostw.exe

Filesize
4.9MB

MD5
f954807077449b5cc1d07ed866dc8e06

SHA1
af066d14f43a45603e8de65123f8816989b392d7

SHA256
eceb9868a4a69e49933d729c6ae015e2c569818ff44dfe41b4341c28c42e9274

SHA512
df0cdb0771fcb063f1e539b01aae5d19c9019dc8aef972180c60682eeeb4d17f1e55198b457978f793fc8bf13e28922f9745be480132598c819ec102e6360f75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\12a3e7f3-042a-4392-a9c9-b3e83a5ce603.vbs

Filesize
705B

MD5
38132b0303e95f320cbbb13ee1e10bf1

SHA1
6451523693f60719db6b28b1c41b4c810bac2198

SHA256
d9f5b0d90830447d4e60151d50b7eba590213c12e58d5a4fd64fb115364b77ba

SHA512
1f3ae4e2f983067fa51b33c03a70f298ad3a6ac8df797820d14da6566fe9fc24e477c03ede13539ed1e4bf1aa91c909e40c97ff6c414b25a2e3bdbc1373bbc64

Download Submit
C:\Users\Admin\AppData\Local\Temp\31ae7dec-e455-4c3b-8a65-496c86dab23c.vbs

Filesize
705B

MD5
1cb87cbad9ddf3dff800e245fc8e2afc

SHA1
c1865e906d91a779723e985145d4efa2b1c08ca5

SHA256
11fb021324b96b950a5c55efb6af6764ff2666072b72bcc480ed53866883694d

SHA512
018ad11ca5aee6f9c1fc2b65882f93fed90cf6234330e3f6de40d9618a588650c0f1dc98fcfb6d607c63d8fc468d92f93cc3ea6fbfb457157c56a6bcea2516b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\4501f43f-e4e8-4f1d-ae33-efea269da67c.vbs

Filesize
705B

MD5
44767084516aef7c8b72f006e87a4c7b

SHA1
c67f7bad556ca405725b805ad7e6cd5b74e23b78

SHA256
9e03306de29e7b2e1ab3f53025872148c141c74c0b7b55a444b2e0be2146dbb4

SHA512
7fe9228fa909c6ef862ffa6e94b21ebeec1a8189d0a14daa3b7ff02e91bd7fec874685fe70578fb49be1f34f519bd63cf6741fa2a17f02130982bf52682d5e30

Download Submit
C:\Users\Admin\AppData\Local\Temp\506a5401-a420-4ddd-8a2d-a4cbc60cf829.vbs

Filesize
705B

MD5
55a8ad037528448c3052c95a94fa92da

SHA1
efb21818964e74a2617cee76f2fe67a33b206c5a

SHA256
a0fc3d4ae94401629f18b6bf77e6eedff16743e59745d597faa91612995d327d

SHA512
fa2e965b0426f7f3d5b78c01c11a595fce4339fb5de6b67e3ab7fe9bba2fb31f9bb2a4cf97bd36d20f5d753e93cdedf3772d427371d7e2f4ebedb19f16f9d252

Download Submit
C:\Users\Admin\AppData\Local\Temp\6c7e4259-dbf9-42b1-bd4e-4695923adeb6.vbs

Filesize
705B

MD5
517d603740028b6056f5420b415d827b

SHA1
2124b402dd820adeddb7e5e82840929cf513279a

SHA256
db7ede47b06050bcc077a0278b85441af9572b959faeb62011f4836fe2c33665

SHA512
bc7b97e19a1e198db86471467f05807bf4116f386305be34206bab59be9450a9addf8ad27c7adeeca189f68b6f1bccad36dc4d86ee26e5a384b906dd23bc7826

Download Submit
C:\Users\Admin\AppData\Local\Temp\7dfee452-36bb-42a3-a3eb-420b8c1246e6.vbs

Filesize
705B

MD5
a2d52b7bad41daac9b4a35b62e6b7326

SHA1
a5f6736fc951575cdbcff392330002f0fffb2d5e

SHA256
efa295a557f62e6af4369f24a42c56b584b0fab5de6d34ca83ddfac35252a152

SHA512
e9839d742118d63992919ce4018d5b0d0e8b232686f40860d5775b01bbe7076f45ce0241b11927f31306281bdb19a879482747db3097b4362e184a284c1b29f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gbohrhbl.122.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d44166a7-4172-4e3c-a69b-464d3432b659.vbs

Filesize
705B

MD5
c6144de374e1144147f79af60197341e

SHA1
2b1f17b2d0bf1655656a839da7e775769836047f

SHA256
aa2d75ee24446c041971d57225f03c93b4a26ef64a9adef8825cd3ec8d8cd380

SHA512
0add72adcd0492dad8f9dfc17dbce31c5045184cdbf88782b9b58fc322a0032c7bdeee8a42eb518b7f8e192f8da27ee82d831103357b0c14ace9e067247a2d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\eefb7da5-0b12-4b90-96af-228c6e14528d.vbs

Filesize
481B

MD5
374b9d1e55cb083d7bf822c9de9592f8

SHA1
aa9e0585a3141e7098ec02957db82374e40f2f4f

SHA256
a3b367706ae6bf112e728d41c80b5e03db8f83638ef72059af3daa48ba219896

SHA512
d53b3051475aebfcb3022d0480e7f48dad57b02c41c5ba29c287d4d0a09bd033d274bbc93d48b9aa42fdd62bbcafeb0a6938f45059ea96354443dd987d2475c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB335.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
memory/3344-535-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download
memory/4624-236-0x0000022A10140000-0x0000022A10162000-memory.dmp

Filesize
136KB

Download
memory/4764-78-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4992-0-0x00007FF83CB53000-0x00007FF83CB55000-memory.dmp

Filesize
8KB

Download
memory/4992-7-0x00000000012A0000-0x00000000012B0000-memory.dmp

Filesize
64KB

Download
memory/4992-16-0x0000000002B30000-0x0000000002B38000-memory.dmp

Filesize
32KB

Download
memory/4992-4-0x0000000001280000-0x000000000129C000-memory.dmp

Filesize
112KB

Download
memory/4992-342-0x00007FF83CB50000-0x00007FF83D611000-memory.dmp

Filesize
10.8MB

Download
memory/4992-3-0x000000001B790000-0x000000001B8BE000-memory.dmp

Filesize
1.2MB

Download
memory/4992-2-0x00007FF83CB50000-0x00007FF83D611000-memory.dmp

Filesize
10.8MB

Download
memory/4992-5-0x000000001B730000-0x000000001B780000-memory.dmp

Filesize
320KB

Download
memory/4992-13-0x0000000002AF0000-0x0000000002AFA000-memory.dmp

Filesize
40KB

Download
memory/4992-145-0x00007FF83CB53000-0x00007FF83CB55000-memory.dmp

Filesize
8KB

Download
memory/4992-6-0x0000000001110000-0x0000000001118000-memory.dmp

Filesize
32KB

Download
memory/4992-160-0x00007FF83CB50000-0x00007FF83D611000-memory.dmp

Filesize
10.8MB

Download
memory/4992-17-0x0000000002B40000-0x0000000002B48000-memory.dmp

Filesize
32KB

Download
memory/4992-14-0x0000000002B10000-0x0000000002B1E000-memory.dmp

Filesize
56KB

Download
memory/4992-1-0x0000000000430000-0x0000000000924000-memory.dmp

Filesize
5.0MB

Download
memory/4992-15-0x0000000002B20000-0x0000000002B2E000-memory.dmp

Filesize
56KB

Download
memory/4992-12-0x000000001C430000-0x000000001C958000-memory.dmp

Filesize
5.2MB

Download
memory/4992-11-0x0000000002AE0000-0x0000000002AF2000-memory.dmp

Filesize
72KB

Download
memory/4992-10-0x0000000002AD0000-0x0000000002ADA000-memory.dmp

Filesize
40KB

Download
memory/4992-9-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/4992-8-0x0000000002AA0000-0x0000000002AB6000-memory.dmp

Filesize
88KB

Download
memory/4992-18-0x000000001B8C0000-0x000000001B8CC000-memory.dmp

Filesize
48KB

Download