colibri | 211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
Size

4.9MB
MD5

e6c3b728178aafda74462752efcc0d1c
SHA1

ca9bc7682c0e6ef226c1f1390e1369b355366c8f
SHA256

211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6
SHA512

2827bf81f1686a96c1e629c8aac38bebb1947393dd0ae2d9e71619c12fc679df9668bfe05fddae04caa3d83cebe7cae4cbeee0e54173054bffadd004cc8b9c5c
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3304	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	2448	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	2448	schtasks.exe	82

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3084-3-0x000000001BFB0000-0x000000001C0DE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2420	powershell.exe
3584	powershell.exe
4420	powershell.exe
4360	powershell.exe
1708	powershell.exe
2400	powershell.exe
3776	powershell.exe
3504	powershell.exe
2752	powershell.exe
4376	powershell.exe
1912	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 42 IoCs

pid	Process
3320	tmp91E3.tmp.exe
4572	tmp91E3.tmp.exe
4728	RuntimeBroker.exe
3956	tmpBFA6.tmp.exe
3344	tmpBFA6.tmp.exe
696	RuntimeBroker.exe
1912	tmpF230.tmp.exe
1080	tmpF230.tmp.exe
2940	tmpF230.tmp.exe
532	RuntimeBroker.exe
4068	tmp21DB.tmp.exe
1180	tmp21DB.tmp.exe
5096	RuntimeBroker.exe
2612	tmp5280.tmp.exe
2732	tmp5280.tmp.exe
3728	RuntimeBroker.exe
2032	tmp8160.tmp.exe
3592	tmp8160.tmp.exe
4876	RuntimeBroker.exe
3520	tmp9E00.tmp.exe
1180	tmp9E00.tmp.exe
4332	RuntimeBroker.exe
3012	tmpCD6D.tmp.exe
3320	tmpCD6D.tmp.exe
2148	RuntimeBroker.exe
3696	tmpE8A6.tmp.exe
3400	tmpE8A6.tmp.exe
2940	tmpE8A6.tmp.exe
2848	RuntimeBroker.exe
3296	tmp1776.tmp.exe
216	tmp1776.tmp.exe
1720	RuntimeBroker.exe
4576	tmp479E.tmp.exe
1968	tmp479E.tmp.exe
1164	RuntimeBroker.exe
4780	tmp8B00.tmp.exe
1704	tmp8B00.tmp.exe
5072	RuntimeBroker.exe
4452	tmpA6E5.tmp.exe
5108	tmpA6E5.tmp.exe
4068	tmpA6E5.tmp.exe
4728	RuntimeBroker.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 3320 set thread context of 4572	3320	tmp91E3.tmp.exe	127
PID 3956 set thread context of 3344	3956	tmpBFA6.tmp.exe	155
PID 1080 set thread context of 2940	1080	tmpF230.tmp.exe	162
PID 4068 set thread context of 1180	4068	tmp21DB.tmp.exe	173
PID 2612 set thread context of 2732	2612	tmp5280.tmp.exe	181
PID 2032 set thread context of 3592	2032	tmp8160.tmp.exe	187
PID 3520 set thread context of 1180	3520	tmp9E00.tmp.exe	193
PID 3012 set thread context of 3320	3012	tmpCD6D.tmp.exe	200
PID 3400 set thread context of 2940	3400	tmpE8A6.tmp.exe	207
PID 3296 set thread context of 216	3296	tmp1776.tmp.exe	213
PID 4576 set thread context of 1968	4576	tmp479E.tmp.exe	219
PID 4780 set thread context of 1704	4780	tmp8B00.tmp.exe	225
PID 5108 set thread context of 4068	5108	tmpA6E5.tmp.exe	232

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX9501.tmp	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCX9EAA.tmp	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\9e8d7a4ca61bd9	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files\Internet Explorer\en-US\6cb0b6c459d5d3	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files\Windows Mail\56085415360792	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\RCXA0BE.tmp	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files (x86)\Common Files\spoolsv.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX9997.tmp	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Triedit\sppsvc.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files\Windows Mail\wininit.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files\Common Files\microsoft shared\Triedit\sppsvc.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\d052879754fc62	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files (x86)\Common Files\f3b6ecef712a24	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\RCXA769.tmp	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files\Windows Mail\RCXABEF.tmp	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files (x86)\Windows Media Player\Icons\csrss.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files (x86)\Windows Sidebar\winlogon.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files (x86)\Windows Sidebar\cc11b995f2a76d	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files\Windows Mail\wininit.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\886983d96e3d3e	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files\Internet Explorer\en-US\dwm.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Program Files\Common Files\microsoft shared\Triedit\0a1fd5f707cd16	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files (x86)\Common Files\spoolsv.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\winlogon.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\dwm.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Triedit\RCXA2D3.tmp	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Program Files (x86)\Common Files\RCXA96D.tmp	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\RemotePackages\RemoteApps\lsass.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Windows\RemotePackages\RemoteApps\6203df4a6bafc7	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Windows\PolicyDefinitions\es-ES\RCX90D8.tmp	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Windows\PolicyDefinitions\es-ES\upfc.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\RCX9C29.tmp	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\lsass.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Windows\PolicyDefinitions\es-ES\upfc.exe	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
File created	C:\Windows\PolicyDefinitions\es-ES\ea1d8f6d871115	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA6E5.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp91E3.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBFA6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5280.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9E00.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1776.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp21DB.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8B00.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF230.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp479E.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA6E5.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF230.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8160.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCD6D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE8A6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE8A6.tmp.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1800	schtasks.exe
2416	schtasks.exe
1960	schtasks.exe
1664	schtasks.exe
2344	schtasks.exe
4848	schtasks.exe
4844	schtasks.exe
1484	schtasks.exe
2352	schtasks.exe
224	schtasks.exe
1400	schtasks.exe
4288	schtasks.exe
3604	schtasks.exe
212	schtasks.exe
1724	schtasks.exe
2412	schtasks.exe
388	schtasks.exe
4452	schtasks.exe
3988	schtasks.exe
2800	schtasks.exe
3460	schtasks.exe
3296	schtasks.exe
2140	schtasks.exe
1136	schtasks.exe
3592	schtasks.exe
4832	schtasks.exe
4904	schtasks.exe
4992	schtasks.exe
2064	schtasks.exe
688	schtasks.exe
1228	schtasks.exe
412	schtasks.exe
4528	schtasks.exe
3024	schtasks.exe
740	schtasks.exe
1736	schtasks.exe
3792	schtasks.exe
1000	schtasks.exe
888	schtasks.exe
3304	schtasks.exe
4944	schtasks.exe
3328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
4360	powershell.exe
4360	powershell.exe
1912	powershell.exe
1912	powershell.exe
4376	powershell.exe
4376	powershell.exe
2400	powershell.exe
2400	powershell.exe
2752	powershell.exe
2752	powershell.exe
2420	powershell.exe
2420	powershell.exe
3584	powershell.exe
3584	powershell.exe
1708	powershell.exe
1708	powershell.exe
4420	powershell.exe
4420	powershell.exe
3504	powershell.exe
3504	powershell.exe
2400	powershell.exe
3776	powershell.exe
3776	powershell.exe
1912	powershell.exe
4360	powershell.exe
2752	powershell.exe
2420	powershell.exe
4376	powershell.exe
3504	powershell.exe
1708	powershell.exe
3584	powershell.exe
3776	powershell.exe
4420	powershell.exe
4728	RuntimeBroker.exe
696	RuntimeBroker.exe
532	RuntimeBroker.exe
5096	RuntimeBroker.exe
3728	RuntimeBroker.exe
4876	RuntimeBroker.exe
4332	RuntimeBroker.exe
2148	RuntimeBroker.exe
2848	RuntimeBroker.exe
1720	RuntimeBroker.exe
1164	RuntimeBroker.exe
5072	RuntimeBroker.exe
4728	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeDebugPrivilege	4728	RuntimeBroker.exe
Token: SeDebugPrivilege	696	RuntimeBroker.exe
Token: SeDebugPrivilege	532	RuntimeBroker.exe
Token: SeDebugPrivilege	5096	RuntimeBroker.exe
Token: SeDebugPrivilege	3728	RuntimeBroker.exe
Token: SeDebugPrivilege	4876	RuntimeBroker.exe
Token: SeDebugPrivilege	4332	RuntimeBroker.exe
Token: SeDebugPrivilege	2148	RuntimeBroker.exe
Token: SeDebugPrivilege	2848	RuntimeBroker.exe
Token: SeDebugPrivilege	1720	RuntimeBroker.exe
Token: SeDebugPrivilege	1164	RuntimeBroker.exe
Token: SeDebugPrivilege	5072	RuntimeBroker.exe
Token: SeDebugPrivilege	4728	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 3320	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	125
PID 3084 wrote to memory of 3320	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	125
PID 3084 wrote to memory of 3320	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	125
PID 3320 wrote to memory of 4572	3320	tmp91E3.tmp.exe	127
PID 3320 wrote to memory of 4572	3320	tmp91E3.tmp.exe	127
PID 3320 wrote to memory of 4572	3320	tmp91E3.tmp.exe	127
PID 3320 wrote to memory of 4572	3320	tmp91E3.tmp.exe	127
PID 3320 wrote to memory of 4572	3320	tmp91E3.tmp.exe	127
PID 3320 wrote to memory of 4572	3320	tmp91E3.tmp.exe	127
PID 3320 wrote to memory of 4572	3320	tmp91E3.tmp.exe	127
PID 3084 wrote to memory of 3776	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	128
PID 3084 wrote to memory of 3776	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	128
PID 3084 wrote to memory of 2400	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	129
PID 3084 wrote to memory of 2400	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	129
PID 3084 wrote to memory of 1912	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	130
PID 3084 wrote to memory of 1912	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	130
PID 3084 wrote to memory of 1708	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	131
PID 3084 wrote to memory of 1708	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	131
PID 3084 wrote to memory of 4360	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	132
PID 3084 wrote to memory of 4360	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	132
PID 3084 wrote to memory of 4376	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	133
PID 3084 wrote to memory of 4376	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	133
PID 3084 wrote to memory of 2752	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	134
PID 3084 wrote to memory of 2752	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	134
PID 3084 wrote to memory of 4420	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	135
PID 3084 wrote to memory of 4420	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	135
PID 3084 wrote to memory of 3584	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	136
PID 3084 wrote to memory of 3584	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	136
PID 3084 wrote to memory of 3504	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	137
PID 3084 wrote to memory of 3504	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	137
PID 3084 wrote to memory of 2420	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	138
PID 3084 wrote to memory of 2420	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	138
PID 3084 wrote to memory of 4728	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	150
PID 3084 wrote to memory of 4728	3084	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe	150
PID 4728 wrote to memory of 4164	4728	RuntimeBroker.exe	151
PID 4728 wrote to memory of 4164	4728	RuntimeBroker.exe	151
PID 4728 wrote to memory of 1208	4728	RuntimeBroker.exe	152
PID 4728 wrote to memory of 1208	4728	RuntimeBroker.exe	152
PID 4728 wrote to memory of 3956	4728	RuntimeBroker.exe	153
PID 4728 wrote to memory of 3956	4728	RuntimeBroker.exe	153
PID 4728 wrote to memory of 3956	4728	RuntimeBroker.exe	153
PID 3956 wrote to memory of 3344	3956	tmpBFA6.tmp.exe	155
PID 3956 wrote to memory of 3344	3956	tmpBFA6.tmp.exe	155
PID 3956 wrote to memory of 3344	3956	tmpBFA6.tmp.exe	155
PID 3956 wrote to memory of 3344	3956	tmpBFA6.tmp.exe	155
PID 3956 wrote to memory of 3344	3956	tmpBFA6.tmp.exe	155
PID 3956 wrote to memory of 3344	3956	tmpBFA6.tmp.exe	155
PID 3956 wrote to memory of 3344	3956	tmpBFA6.tmp.exe	155
PID 4164 wrote to memory of 696	4164	WScript.exe	156
PID 4164 wrote to memory of 696	4164	WScript.exe	156
PID 696 wrote to memory of 4920	696	RuntimeBroker.exe	157
PID 696 wrote to memory of 4920	696	RuntimeBroker.exe	157
PID 696 wrote to memory of 5024	696	RuntimeBroker.exe	158
PID 696 wrote to memory of 5024	696	RuntimeBroker.exe	158
PID 696 wrote to memory of 1912	696	RuntimeBroker.exe	159
PID 696 wrote to memory of 1912	696	RuntimeBroker.exe	159
PID 696 wrote to memory of 1912	696	RuntimeBroker.exe	159
PID 1912 wrote to memory of 1080	1912	tmpF230.tmp.exe	161
PID 1912 wrote to memory of 1080	1912	tmpF230.tmp.exe	161
PID 1912 wrote to memory of 1080	1912	tmpF230.tmp.exe	161
PID 1080 wrote to memory of 2940	1080	tmpF230.tmp.exe	162
PID 1080 wrote to memory of 2940	1080	tmpF230.tmp.exe	162
PID 1080 wrote to memory of 2940	1080	tmpF230.tmp.exe	162
PID 1080 wrote to memory of 2940	1080	tmpF230.tmp.exe	162

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe
"C:\Users\Admin\AppData\Local\Temp\211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3084
- C:\Users\Admin\AppData\Local\Temp\tmp91E3.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp91E3.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Users\Admin\AppData\Local\Temp\tmp91E3.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp91E3.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
  "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4728
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eaccd3fc-6bee-45bf-a3e9-5c956791f03a.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
      "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:696
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49d1a0ab-318e-440e-9e87-33a56b996e2f.vbs"
        5⤵
        
        PID:4920
      - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e8c8f4a7-2658-4693-ba62-80d811d90b29.vbs"
        7⤵
        
        PID:1376
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ff389c6-b360-4937-bf70-0726dfd29376.vbs"
        9⤵
        
        PID:1696
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83833cc8-3671-422b-8a01-5f1d4e619e59.vbs"
        11⤵
        
        PID:5068
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1e9497d-970a-4486-a99b-2449fb81b1f3.vbs"
        13⤵
        
        PID:3584
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a9f4863-14ac-4bee-a77e-fabc0bc70463.vbs"
        15⤵
        
        PID:3332
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2148
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8ad693f-8aa4-4cf0-b712-3bd7e56b2017.vbs"
        17⤵
        
        PID:3944
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6269f40-9f8c-4f38-ab74-1da8a38fc104.vbs"
        19⤵
        
        PID:1840
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\13eafbb5-8fbb-4f83-8c23-a6d35b7e9d71.vbs"
        21⤵
        
        PID:720
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1164
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ee69ce2-0e37-4cb4-9ca2-729b07cffe5e.vbs"
        23⤵
        
        PID:3968
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5072
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6bbad54-0c7f-4bf4-8a46-f9a58ff4554e.vbs"
        25⤵
        
        PID:3596
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe"
        26⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be64b424-8ce6-43ff-9e22-3a8e6b09ec39.vbs"
        25⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\tmpA6E5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA6E5.tmp.exe"
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\tmpA6E5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA6E5.tmp.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\tmpA6E5.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA6E5.tmp.exe"
        27⤵
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5566bb6-1452-4c74-8aed-175c4f2de3b8.vbs"
        23⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\tmp8B00.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8B00.tmp.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\tmp8B00.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8B00.tmp.exe"
        24⤵
        Executes dropped EXE
        
        PID:1704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\443b552a-582e-4c85-8b8a-9dfdc6f6486d.vbs"
        21⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\tmp479E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp479E.tmp.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\tmp479E.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp479E.tmp.exe"
        22⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0633fbc-cdfd-4935-ab41-0ac077f91f4e.vbs"
        19⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\tmp1776.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1776.tmp.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\tmp1776.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1776.tmp.exe"
        20⤵
        Executes dropped EXE
        
        PID:216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54be8925-5b73-4d4d-b0a6-9d774da73738.vbs"
        17⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\tmpE8A6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE8A6.tmp.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\tmpE8A6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE8A6.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\tmpE8A6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE8A6.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:2940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5c1beeb-5433-473e-8d35-08a341194c18.vbs"
        15⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\tmpCD6D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCD6D.tmp.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\tmpCD6D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpCD6D.tmp.exe"
        16⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10398dee-6072-4215-adf0-0cbf87f363d7.vbs"
        13⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\tmp9E00.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9E00.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\tmp9E00.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9E00.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd268fb2-c22f-4a32-a573-68a29097fddf.vbs"
        11⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\tmp8160.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8160.tmp.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\tmp8160.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp8160.tmp.exe"
        12⤵
        Executes dropped EXE
        
        PID:3592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a43712f6-cdcd-469f-b55f-a1cff064d3b0.vbs"
        9⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe"
        10⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5fc86a4-b578-4cbb-a508-274f5efda33c.vbs"
        7⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\tmp21DB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp21DB.tmp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\tmp21DB.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp21DB.tmp.exe"
        8⤵
        Executes dropped EXE
        
        PID:1180
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90fb1f61-1c64-4daa-8200-6338f639ef8b.vbs"
        5⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\tmpF230.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF230.tmp.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\tmpF230.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF230.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\tmpF230.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF230.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:2940
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c06f5c5a-4a1b-4909-8a4a-8990dace2fed.vbs"
    3⤵
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\tmpBFA6.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpBFA6.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\tmpBFA6.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpBFA6.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:3344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Windows\PolicyDefinitions\es-ES\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\es-ES\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Windows\PolicyDefinitions\es-ES\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\RemotePackages\RemoteApps\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\RemoteApps\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\en-US\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Pictures\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Pictures\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Documents\My Pictures\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f62" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f62" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe

Filesize
4.9MB

MD5
bb22d8bdf1f845986f9a7ddee13a2b85

SHA1
2e02439781a89ec03b3e7ee9474501d72711415c

SHA256
7f6f8a454299cf5663f2bab68694548e3c4e46e0dafc1ef53db1b63ce3ec0acf

SHA512
dfd37d6f3dc26cc2b95adcf09edf724cdba1b98fe789bbf40e09bc15f6935f569278cb11df2f190ec21782c5aa11a8b2fdedc65546ae9ff5371f1ce841528d93

Download Submit
C:\Program Files\Windows Mail\wininit.exe

Filesize
4.9MB

MD5
45882692da219f4c8d0d135b881cdf8e

SHA1
e630ba65e41ef3a75cdd81405a9b028d595b41a8

SHA256
da4506ecdfe85359c0787279cf6bbcf4be060277a9fdcd6dc451a30f279fbd91

SHA512
f0cbb663471473363a22f39bd73e798986ca5b80c41220f79802afa91985b0597785b5b8b2aa4a4ead4848fdef243464c83ff695d2462315631d8166cba1c7ea

Download Submit
C:\Recovery\WindowsRE\RCX9783.tmp

Filesize
4.9MB

MD5
69258c2898146be00530f327e9079ce2

SHA1
d5c2a556400a855169a4d12ca4ac246f91f73e56

SHA256
d2adcf5e24ad0acff031ae4eacadf2f578380515372349cfd9a462cf4e343887

SHA512
e31ccfabc5b52ac531fcce46b0809ecb4ce102fe7365629ac551265a710f2455c6c706a57ddfd30df7b45f552bcb477148b29e4bd58f74e9992253d6f5dbf15e

Download Submit
C:\Recovery\WindowsRE\taskhostw.exe

Filesize
4.9MB

MD5
e6c3b728178aafda74462752efcc0d1c

SHA1
ca9bc7682c0e6ef226c1f1390e1369b355366c8f

SHA256
211189ad4ee0ba326b3de856c081a2604649874e737f1cb5459d34db06d443f6

SHA512
2827bf81f1686a96c1e629c8aac38bebb1947393dd0ae2d9e71619c12fc679df9668bfe05fddae04caa3d83cebe7cae4cbeee0e54173054bffadd004cc8b9c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\0a9f4863-14ac-4bee-a77e-fabc0bc70463.vbs

Filesize
761B

MD5
2f871264105431446bb03258daf0ad7a

SHA1
75899e0c731fb110221527187e87a6caad28d76a

SHA256
96a41ba3f7f0213855aad54e6598d5365b492fdfd4e79a68f2df7f40b0eaf608

SHA512
3c9b5c801a8b7e1e06127379dbd554886efa2e77050ebd86aea507861b235244355d899d5c846657f48b95029275b8e067cae6297326034bf4505ffc96a2aee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\49d1a0ab-318e-440e-9e87-33a56b996e2f.vbs

Filesize
760B

MD5
21c886425fce7d6a7efb6ee122cd5c61

SHA1
554e7aa9f95aaad9072b896c337c6ff091fe41e8

SHA256
43b7983540eee2ee0ddc62a53507e8a22becfb4aea06b7b02690adfcebd1b069

SHA512
a790de3a249cb807633c21ae3f09151ca8f2e1a24ad691c931d767f62e2063b052d68f14803713d808051b9344686d9a1fea46297449d3ee0c41d33633c4e3b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ff389c6-b360-4937-bf70-0726dfd29376.vbs

Filesize
761B

MD5
9a6823c3735da05048bbe0f454ade877

SHA1
90c142873360e683586acffc34e097553b1297fc

SHA256
37f5c5598e9ca43c675dea68518c7ab8b378ce1fe0b8c405f17676bc88313306

SHA512
30f876541453ec07ed5bbf5993127dfbd7be9a686a38912c14a6162670f6f47b3a5b24a40b066840d94e8a7cf9245c45a3b6558e267f3b7cd38a104fc6f34b55

Download Submit
C:\Users\Admin\AppData\Local\Temp\83833cc8-3671-422b-8a01-5f1d4e619e59.vbs

Filesize
761B

MD5
0ff8ce3f739ccfef6a42585ef1d061fd

SHA1
1c8d55832fc9e2d3eb48182483b60a789f5fbefc

SHA256
ffe79c22d026d68e4ebd00ef521805721a6277d7c55c4f794dd1bdfea9a18f0c

SHA512
d0e615009b50351ce2e5f7ba6a25c4a70fbcb1f2cddbaf8104dc2662de6088b62cfffe744f9ed1f2aae5ef49803c87cc0cadc3644378361aec8ebf6e1b0927c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_csstzolu.dpn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c06f5c5a-4a1b-4909-8a4a-8990dace2fed.vbs

Filesize
537B

MD5
ef2192c2223975e9939c7480322634f6

SHA1
6cd059a652226c93fc8f5b9558ff4347818c089a

SHA256
a7b07328a19065cbf8a90ef36072793b60984aa2aa608d55c2be477ba38112fc

SHA512
35a4bfba378041804098f3e865e4b28f70b012aa17b59752c7a9f2bd38949e0c49c088fb37a61d22804c1826baf328843a7ae4f86e0ef83f780dc3b328962207

Download Submit
C:\Users\Admin\AppData\Local\Temp\c1e9497d-970a-4486-a99b-2449fb81b1f3.vbs

Filesize
761B

MD5
1405034ffe0a3db5ebe8e0f9d394172c

SHA1
073c7e3088f99540a6f4fc37d60a9993707fae50

SHA256
b6308c684f859bd73a6d883d249741ae7307828fd0d409ad5ba1d6e9e14afddd

SHA512
934d60c6ff23d8bf6c89bea0b0168f380868414c66fc79c01d0ebf83027fd5397728bf71b085d81be4a156febdb1aff2d81f9c5689fb114ad3b6ef68a1cca832

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8c8f4a7-2658-4693-ba62-80d811d90b29.vbs

Filesize
760B

MD5
6f3dfacf4fe4c1ba3729f1302878044d

SHA1
9146488865e00b4aa782c459faccd4d99350bf60

SHA256
606ebdbd509c37b2f5d0562c6e78c581d58f71949c4103b3ea409b94b9d6a310

SHA512
ec36be905141d54d83891f54d36a837387de8926715a536f1117005d857e1aa01a0d3f809a8fb7fe43228c9ab779dd8b23695710da49efff09f6085e3ba08326

Download Submit
C:\Users\Admin\AppData\Local\Temp\eaccd3fc-6bee-45bf-a3e9-5c956791f03a.vbs

Filesize
761B

MD5
fb6fdf97c270cd99b221340c308b8361

SHA1
df24a5e4a4e8d308a70d9a1548b0173ddd631199

SHA256
0f17262379ef9623d6ac3bd4d75b721798deb195a1887cb2428fbcf6b52894cc

SHA512
f8da074f7dda91ac9ec49ef90db8b193f98507f27e56d449103bc16a6796f9512b9b73a3b95c2ccac160a1b56c692529d2bca2ad2c412019d6ed9d7f6682b8e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp91E3.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
memory/1720-538-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download
memory/2752-213-0x00000232C5450000-0x00000232C5472000-memory.dmp

Filesize
136KB

Download
memory/2848-521-0x000000001D5F0000-0x000000001D602000-memory.dmp

Filesize
72KB

Download
memory/3084-1-0x0000000000D70000-0x0000000001264000-memory.dmp

Filesize
5.0MB

Download
memory/3084-18-0x000000001C910000-0x000000001C91C000-memory.dmp

Filesize
48KB

Download
memory/3084-9-0x00000000034B0000-0x00000000034C0000-memory.dmp

Filesize
64KB

Download
memory/3084-141-0x00007FFC7EB33000-0x00007FFC7EB35000-memory.dmp

Filesize
8KB

Download
memory/3084-316-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/3084-7-0x00000000034A0000-0x00000000034B0000-memory.dmp

Filesize
64KB

Download
memory/3084-5-0x000000001C780000-0x000000001C7D0000-memory.dmp

Filesize
320KB

Download
memory/3084-4-0x0000000003460000-0x000000000347C000-memory.dmp

Filesize
112KB

Download
memory/3084-3-0x000000001BFB0000-0x000000001C0DE000-memory.dmp

Filesize
1.2MB

Download
memory/3084-0-0x00007FFC7EB33000-0x00007FFC7EB35000-memory.dmp

Filesize
8KB

Download
memory/3084-2-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/3084-6-0x0000000003490000-0x0000000003498000-memory.dmp

Filesize
32KB

Download
memory/3084-11-0x000000001C150000-0x000000001C162000-memory.dmp

Filesize
72KB

Download
memory/3084-10-0x000000001C140000-0x000000001C14A000-memory.dmp

Filesize
40KB

Download
memory/3084-17-0x000000001C800000-0x000000001C808000-memory.dmp

Filesize
32KB

Download
memory/3084-8-0x000000001C120000-0x000000001C136000-memory.dmp

Filesize
88KB

Download
memory/3084-154-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/3084-16-0x000000001C7F0000-0x000000001C7F8000-memory.dmp

Filesize
32KB

Download
memory/3084-15-0x000000001C7E0000-0x000000001C7EE000-memory.dmp

Filesize
56KB

Download
memory/3084-14-0x000000001C7D0000-0x000000001C7DE000-memory.dmp

Filesize
56KB

Download
memory/3084-13-0x000000001C160000-0x000000001C16A000-memory.dmp

Filesize
40KB

Download
memory/3084-12-0x000000001CD00000-0x000000001D228000-memory.dmp

Filesize
5.2MB

Download
memory/4572-80-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4728-315-0x0000000000F60000-0x0000000001454000-memory.dmp

Filesize
5.0MB

Download