colibri | d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869

Analysis

max time kernel
117s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Size

4.9MB
MD5

d38526128c39b9be768f702680a8345b
SHA1

b315d0373e8689816eb8b320b1a37b646ca090fc
SHA256

d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869
SHA512

98a0dc113ac897acf98722343a0c333e28b98baf58c2931773998cd1ea0b3d5c65964fa7b94c6f3769f1756b0cea366bd9e70af2ae2350c28c630d4a2f9f2dd1
SSDEEP

49152:Ll5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx80:8

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	184	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	652	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	3976	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	3976	schtasks.exe	83

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4768-3-0x000000001B740000-0x000000001B86E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3448	powershell.exe
4584	powershell.exe
4344	powershell.exe
1108	powershell.exe
912	powershell.exe
5044	powershell.exe
2056	powershell.exe
2396	powershell.exe
2608	powershell.exe
4012	powershell.exe
728	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 36 IoCs

pid	Process
3408	tmp863A.tmp.exe
3188	tmp863A.tmp.exe
2256	dllhost.exe
2396	tmpC285.tmp.exe
1148	tmpC285.tmp.exe
800	dllhost.exe
3264	tmpDE2B.tmp.exe
4780	tmpDE2B.tmp.exe
4448	dllhost.exe
3492	tmpDC6.tmp.exe
1484	tmpDC6.tmp.exe
2328	dllhost.exe
2708	tmp3C58.tmp.exe
4492	tmp3C58.tmp.exe
3996	dllhost.exe
3796	tmp6BA6.tmp.exe
4956	tmp6BA6.tmp.exe
4276	tmp6BA6.tmp.exe
2680	dllhost.exe
2012	dllhost.exe
2708	tmpA41B.tmp.exe
216	tmpA41B.tmp.exe
676	dllhost.exe
1096	dllhost.exe
2588	tmpDC32.tmp.exe
3300	tmpDC32.tmp.exe
4984	dllhost.exe
4032	tmpF76B.tmp.exe
2708	tmpF76B.tmp.exe
4716	dllhost.exe
4908	tmp1284.tmp.exe
2632	tmp1284.tmp.exe
3140	dllhost.exe
688	tmp41A3.tmp.exe
3908	tmp41A3.tmp.exe
4604	tmp41A3.tmp.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 3408 set thread context of 3188	3408	tmp863A.tmp.exe	126
PID 2396 set thread context of 1148	2396	tmpC285.tmp.exe	170
PID 3264 set thread context of 4780	3264	tmpDE2B.tmp.exe	182
PID 3492 set thread context of 1484	3492	tmpDC6.tmp.exe	195
PID 2708 set thread context of 4492	2708	tmp3C58.tmp.exe	204
PID 4956 set thread context of 4276	4956	tmp6BA6.tmp.exe	214
PID 2708 set thread context of 216	2708	tmpA41B.tmp.exe	229
PID 2588 set thread context of 3300	2588	tmpDC32.tmp.exe	244
PID 4032 set thread context of 2708	4032	tmpF76B.tmp.exe	253
PID 4908 set thread context of 2632	4908	tmp1284.tmp.exe	262
PID 3908 set thread context of 4604	3908	tmp41A3.tmp.exe	272

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\9e8d7a4ca61bd9	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\RCX8510.tmp	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\StartMenuExperienceHost.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RCX8959.tmp	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\dwm.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\b8c5dd9ba8a803	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\Java\jdk-1.8\bin\taskhostw.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX9208.tmp	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX9B43.tmp	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\Mozilla Firefox\defaults\ea9f0e6c9e2dcd	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\dotnet\swidtag\5940a34987c991	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ea9f0e6c9e2dcd	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\Windows Media Player\RuntimeBroker.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\55b276f4edf653	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\RCX941C.tmp	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\RCX8735.tmp	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\RCX9DD4.tmp	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\taskhostw.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\dotnet\swidtag\dllhost.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\Windows Media Player\RuntimeBroker.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\dwm.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\dotnet\swidtag\dllhost.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\taskhostw.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\6cb0b6c459d5d3	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\StartMenuExperienceHost.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Program Files\Mozilla Firefox\defaults\taskhostw.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Vss\e6c9b481da804f	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Windows\Provisioning\Cosa\upfc.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Windows\Provisioning\Cosa\ea1d8f6d871115	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Windows\Vss\RCX9003.tmp	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Windows\Vss\OfficeClickToRun.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Windows\Provisioning\Cosa\RCX98C2.tmp	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File opened for modification	C:\Windows\Provisioning\Cosa\upfc.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
File created	C:\Windows\Vss\OfficeClickToRun.exe	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp41A3.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp863A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC285.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6BA6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA41B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF76B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp41A3.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDE2B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDC6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp3C58.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6BA6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpDC32.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp1284.tmp.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
184	schtasks.exe
2640	schtasks.exe
5056	schtasks.exe
3128	schtasks.exe
652	schtasks.exe
3612	schtasks.exe
2064	schtasks.exe
4568	schtasks.exe
1840	schtasks.exe
3608	schtasks.exe
4780	schtasks.exe
2776	schtasks.exe
2388	schtasks.exe
2420	schtasks.exe
3348	schtasks.exe
4360	schtasks.exe
1440	schtasks.exe
3624	schtasks.exe
4144	schtasks.exe
4852	schtasks.exe
2336	schtasks.exe
1400	schtasks.exe
4868	schtasks.exe
692	schtasks.exe
4944	schtasks.exe
2976	schtasks.exe
2540	schtasks.exe
2268	schtasks.exe
3036	schtasks.exe
3668	schtasks.exe
4012	schtasks.exe
3340	schtasks.exe
536	schtasks.exe
1040	schtasks.exe
3692	schtasks.exe
2424	schtasks.exe
684	schtasks.exe
1652	schtasks.exe
2808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
1108	powershell.exe
1108	powershell.exe
2056	powershell.exe
2056	powershell.exe
2608	powershell.exe
2608	powershell.exe
4012	powershell.exe
4012	powershell.exe
728	powershell.exe
728	powershell.exe
2396	powershell.exe
2396	powershell.exe
3448	powershell.exe
3448	powershell.exe
912	powershell.exe
912	powershell.exe
4584	powershell.exe
4584	powershell.exe
2396	powershell.exe
5044	powershell.exe
5044	powershell.exe
4344	powershell.exe
4344	powershell.exe
728	powershell.exe
1108	powershell.exe
4584	powershell.exe
4012	powershell.exe
2608	powershell.exe
3448	powershell.exe
2056	powershell.exe
2056	powershell.exe
912	powershell.exe
5044	powershell.exe
4344	powershell.exe
2256	dllhost.exe
800	dllhost.exe
4448	dllhost.exe
2328	dllhost.exe
3996	dllhost.exe
2680	dllhost.exe
2012	dllhost.exe
676	dllhost.exe
1096	dllhost.exe
4984	dllhost.exe
4716	dllhost.exe
3140	dllhost.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	2256	dllhost.exe
Token: SeDebugPrivilege	800	dllhost.exe
Token: SeDebugPrivilege	4448	dllhost.exe
Token: SeDebugPrivilege	2328	dllhost.exe
Token: SeDebugPrivilege	3996	dllhost.exe
Token: SeDebugPrivilege	2680	dllhost.exe
Token: SeDebugPrivilege	2012	dllhost.exe
Token: SeDebugPrivilege	676	dllhost.exe
Token: SeDebugPrivilege	1096	dllhost.exe
Token: SeDebugPrivilege	4984	dllhost.exe
Token: SeDebugPrivilege	4716	dllhost.exe
Token: SeDebugPrivilege	3140	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3408	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	124
PID 4768 wrote to memory of 3408	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	124
PID 4768 wrote to memory of 3408	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	124
PID 3408 wrote to memory of 3188	3408	tmp863A.tmp.exe	126
PID 3408 wrote to memory of 3188	3408	tmp863A.tmp.exe	126
PID 3408 wrote to memory of 3188	3408	tmp863A.tmp.exe	126
PID 3408 wrote to memory of 3188	3408	tmp863A.tmp.exe	126
PID 3408 wrote to memory of 3188	3408	tmp863A.tmp.exe	126
PID 3408 wrote to memory of 3188	3408	tmp863A.tmp.exe	126
PID 3408 wrote to memory of 3188	3408	tmp863A.tmp.exe	126
PID 4768 wrote to memory of 4344	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	129
PID 4768 wrote to memory of 4344	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	129
PID 4768 wrote to memory of 1108	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	130
PID 4768 wrote to memory of 1108	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	130
PID 4768 wrote to memory of 728	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	131
PID 4768 wrote to memory of 728	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	131
PID 4768 wrote to memory of 4584	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	132
PID 4768 wrote to memory of 4584	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	132
PID 4768 wrote to memory of 912	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	133
PID 4768 wrote to memory of 912	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	133
PID 4768 wrote to memory of 3448	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	134
PID 4768 wrote to memory of 3448	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	134
PID 4768 wrote to memory of 2396	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	135
PID 4768 wrote to memory of 2396	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	135
PID 4768 wrote to memory of 2056	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	136
PID 4768 wrote to memory of 2056	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	136
PID 4768 wrote to memory of 4012	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	138
PID 4768 wrote to memory of 4012	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	138
PID 4768 wrote to memory of 5044	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	139
PID 4768 wrote to memory of 5044	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	139
PID 4768 wrote to memory of 2608	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	140
PID 4768 wrote to memory of 2608	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	140
PID 4768 wrote to memory of 3268	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	150
PID 4768 wrote to memory of 3268	4768	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe	150
PID 3268 wrote to memory of 4928	3268	cmd.exe	153
PID 3268 wrote to memory of 4928	3268	cmd.exe	153
PID 3268 wrote to memory of 2256	3268	cmd.exe	160
PID 3268 wrote to memory of 2256	3268	cmd.exe	160
PID 2256 wrote to memory of 676	2256	dllhost.exe	164
PID 2256 wrote to memory of 676	2256	dllhost.exe	164
PID 2256 wrote to memory of 3116	2256	dllhost.exe	165
PID 2256 wrote to memory of 3116	2256	dllhost.exe	165
PID 2256 wrote to memory of 2396	2256	dllhost.exe	168
PID 2256 wrote to memory of 2396	2256	dllhost.exe	168
PID 2256 wrote to memory of 2396	2256	dllhost.exe	168
PID 2396 wrote to memory of 1148	2396	tmpC285.tmp.exe	170
PID 2396 wrote to memory of 1148	2396	tmpC285.tmp.exe	170
PID 2396 wrote to memory of 1148	2396	tmpC285.tmp.exe	170
PID 2396 wrote to memory of 1148	2396	tmpC285.tmp.exe	170
PID 2396 wrote to memory of 1148	2396	tmpC285.tmp.exe	170
PID 2396 wrote to memory of 1148	2396	tmpC285.tmp.exe	170
PID 2396 wrote to memory of 1148	2396	tmpC285.tmp.exe	170
PID 676 wrote to memory of 800	676	WScript.exe	176
PID 676 wrote to memory of 800	676	WScript.exe	176
PID 800 wrote to memory of 5008	800	dllhost.exe	178
PID 800 wrote to memory of 5008	800	dllhost.exe	178
PID 800 wrote to memory of 3084	800	dllhost.exe	179
PID 800 wrote to memory of 3084	800	dllhost.exe	179
PID 800 wrote to memory of 3264	800	dllhost.exe	180
PID 800 wrote to memory of 3264	800	dllhost.exe	180
PID 800 wrote to memory of 3264	800	dllhost.exe	180
PID 3264 wrote to memory of 4780	3264	tmpDE2B.tmp.exe	182
PID 3264 wrote to memory of 4780	3264	tmpDE2B.tmp.exe	182
PID 3264 wrote to memory of 4780	3264	tmpDE2B.tmp.exe	182

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe
"C:\Users\Admin\AppData\Local\Temp\d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4768
- C:\Users\Admin\AppData\Local\Temp\tmp863A.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp863A.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Users\Admin\AppData\Local\Temp\tmp863A.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp863A.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:3188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pWf3I9YR0J.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4928
- - C:\Program Files\dotnet\swidtag\dllhost.exe
    "C:\Program Files\dotnet\swidtag\dllhost.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2256
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e8e791e-f72c-4c7b-b4d4-d301d871988f.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:676
    - - C:\Program Files\dotnet\swidtag\dllhost.exe
        
        "C:\Program Files\dotnet\swidtag\dllhost.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:800
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f167fc3-7239-4ff8-ba76-5709991343bf.vbs"
        6⤵
        
        PID:5008
        
        C:\Program Files\dotnet\swidtag\dllhost.exe
        
        "C:\Program Files\dotnet\swidtag\dllhost.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66e9f5d8-aefc-4981-9057-24a8bc7674b9.vbs"
        8⤵
        
        PID:4620
        
        C:\Program Files\dotnet\swidtag\dllhost.exe
        
        "C:\Program Files\dotnet\swidtag\dllhost.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1c58e84-5c86-490f-b176-cb361ef65c4d.vbs"
        10⤵
        
        PID:4404
        
        C:\Program Files\dotnet\swidtag\dllhost.exe
        
        "C:\Program Files\dotnet\swidtag\dllhost.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80e60649-b803-4f7f-87fd-ea6018d2b93d.vbs"
        12⤵
        
        PID:4328
        
        C:\Program Files\dotnet\swidtag\dllhost.exe
        
        "C:\Program Files\dotnet\swidtag\dllhost.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eca238d6-3697-43c7-980a-f81f295acd7c.vbs"
        14⤵
        
        PID:4352
        
        C:\Program Files\dotnet\swidtag\dllhost.exe
        
        "C:\Program Files\dotnet\swidtag\dllhost.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc4a9f83-5d8b-4f8c-8445-2655ccd9af9f.vbs"
        16⤵
        
        PID:4208
        
        C:\Program Files\dotnet\swidtag\dllhost.exe
        
        "C:\Program Files\dotnet\swidtag\dllhost.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e4d6a0c-1f47-4040-a5a8-045198979ae9.vbs"
        18⤵
        
        PID:3888
        
        C:\Program Files\dotnet\swidtag\dllhost.exe
        
        "C:\Program Files\dotnet\swidtag\dllhost.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7acea83-76fc-49be-a7e6-36eb7233f6c7.vbs"
        20⤵
        
        PID:892
        
        C:\Program Files\dotnet\swidtag\dllhost.exe
        
        "C:\Program Files\dotnet\swidtag\dllhost.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\851e7f60-1779-44f2-809a-40665ce205c1.vbs"
        22⤵
        
        PID:4112
        
        C:\Program Files\dotnet\swidtag\dllhost.exe
        
        "C:\Program Files\dotnet\swidtag\dllhost.exe"
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9deae458-a251-4ca5-adc7-766f207b7fcc.vbs"
        24⤵
        
        PID:4292
        
        C:\Program Files\dotnet\swidtag\dllhost.exe
        
        "C:\Program Files\dotnet\swidtag\dllhost.exe"
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bcc791c0-afc7-4711-8d9d-026736b2fd33.vbs"
        26⤵
        
        PID:4572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6154759e-2ea7-4227-89dd-3e361fdbb8ef.vbs"
        26⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\tmp41A3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp41A3.tmp.exe"
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\tmp41A3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp41A3.tmp.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\tmp41A3.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp41A3.tmp.exe"
        28⤵
        Executes dropped EXE
        
        PID:4604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c251bc00-f545-4922-ba6e-4c3afc981b45.vbs"
        24⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\tmp1284.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1284.tmp.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\tmp1284.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp1284.tmp.exe"
        25⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\359ae201-f988-44bf-aee1-5751d6db3ad1.vbs"
        22⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\tmpF76B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF76B.tmp.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\tmpF76B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF76B.tmp.exe"
        23⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae5193bc-f5c6-424f-b340-f10a740623cf.vbs"
        20⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\tmpDC32.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDC32.tmp.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\tmpDC32.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDC32.tmp.exe"
        21⤵
        Executes dropped EXE
        
        PID:3300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dcad7787-369d-40c3-9633-6bdda7d0fc81.vbs"
        18⤵
        
        PID:1176
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52c009ae-a24d-4b4a-bde9-a9e53eacb640.vbs"
        16⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\tmpA41B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA41B.tmp.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\tmpA41B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpA41B.tmp.exe"
        17⤵
        Executes dropped EXE
        
        PID:216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec7d0ab2-5273-4a11-84f2-68a09c983bf7.vbs"
        14⤵
        
        PID:632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\040cb4fa-e2d4-4263-886e-273fe4a5b87b.vbs"
        12⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\tmp6BA6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6BA6.tmp.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\tmp6BA6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6BA6.tmp.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\tmp6BA6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6BA6.tmp.exe"
        14⤵
        Executes dropped EXE
        
        PID:4276
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9cfd132-9e8e-4c7a-9432-61b3fe3c8d7b.vbs"
        10⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\tmp3C58.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3C58.tmp.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\tmp3C58.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp3C58.tmp.exe"
        11⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\004811e2-ed85-4a08-8f00-91779e019568.vbs"
        8⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\tmpDC6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDC6.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\tmpDC6.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDC6.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:1484
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd90b6b2-72e7-4735-a812-3ec2c551d460.vbs"
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\tmpDE2B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDE2B.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\tmpDE2B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpDE2B.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:4780
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55b0bb72-1900-4d4b-954e-6596fbbfd4b7.vbs"
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\tmpC285.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpC285.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\tmpC285.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC285.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\swidtag\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\swidtag\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Desktop\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\Desktop\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Desktop\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Windows\Vss\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Vss\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\Vss\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jdk-1.8\bin\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\bin\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jdk-1.8\bin\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869d" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\browser\features\d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\features\d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869d" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\browser\features\d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Windows\Provisioning\Cosa\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\Provisioning\Cosa\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Windows\Provisioning\Cosa\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\defaults\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\defaults\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e8e791e-f72c-4c7b-b4d4-d301d871988f.vbs

Filesize
719B

MD5
94b8f6d94d45d2392928210a9fc69774

SHA1
ba6d6b5f64e8a1f7b7d6639e83c5cf69cb514b8f

SHA256
19b88c02f0453bf4e7246c9b90878e4fc3da9dc8453d0132e8c46f3bbd895c0e

SHA512
e1a8e0df29b75f176ea0532032eb459cf7629920907a57e0abc9608bb08246c801f980751c26bad978b01a08e3d45f2c2f564b6f4011a2472544a477da84a87c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4f167fc3-7239-4ff8-ba76-5709991343bf.vbs

Filesize
718B

MD5
577c41de457a6208eb3d27a82bc6721a

SHA1
28ce26d53e41972ce5ed637061da1c2f6b808ed1

SHA256
113c8aac113e3f30ae883f0c87d2dc9ad662d67ea86bb19b4fb025c337f31ec7

SHA512
6455e7cf1453fa3371b63e435f783441132b1e07f1eab577fe44a95e056edc5a56decbbcdbe9cf1404c23670337d300ddf132e9e887f6af6a0600fb3ac444b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\55b0bb72-1900-4d4b-954e-6596fbbfd4b7.vbs

Filesize
495B

MD5
5bba598cced1c6603ffd8e121f96dd8f

SHA1
050cae1d598892bb09858ce64bfa9b99a63121f8

SHA256
63f477604f8243acd019e8fa9bb017d6ee8d20724bd61ccced662d5d6187a319

SHA512
ff7192c821e1569a412c623d45ebdc24c5217ed240866caa23ee07952513dcc969d3581897e511b3953e52097a735c720075211da3acdfd98eecb00a15feed8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\66e9f5d8-aefc-4981-9057-24a8bc7674b9.vbs

Filesize
719B

MD5
fcd8c858986e4604c4de77bdffd8c558

SHA1
5e84cc5c0cabb2f4dbdd572735b91963d5a00728

SHA256
1f89d0de31aa99b0bab7fe1be2397934be95b611af9fccd8489026ef266ab48f

SHA512
7355d10b325b2a74ba78802c2d5a6fedd1403b0a8702b68ce21b0f22af785b31c59acc837d659d18167d16fab6d8e2fafe748efb557793ffebbae3da8be83a74

Download Submit
C:\Users\Admin\AppData\Local\Temp\80e60649-b803-4f7f-87fd-ea6018d2b93d.vbs

Filesize
719B

MD5
8a79eaaa62b1fab670434b67e4d86efb

SHA1
8505c09c324e5d1f629d5975636c83e7a2ab7561

SHA256
ec8d20d456151abdf55741202fa50f9de046ad140195ca1b8e638889ccbc3fb3

SHA512
8daaa7af665a3cd94e8bb0f221f384c5ea91c8ccafd49b0597ae32eee9c56ab9592eab2f3e2eb5ba350b57ccbe632d1866a272db0b7d5bd638179887eb8611d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qmcsiusf.bj5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1c58e84-5c86-490f-b176-cb361ef65c4d.vbs

Filesize
719B

MD5
53e7136885b4175ff403c548f3d5a6cc

SHA1
168856c225b9910316d95629df3ec70aabc84510

SHA256
495fd2a744e9e01ec5c7f8ecab09c6f149f8b26a7451c44634b200e136f1250a

SHA512
cbd77b58b1bb2213f553c7350d78b46a7bc334ebaee13298c3bab2c24196b74bc68fffac5dc8f24563688d554998dcb770284c0578ab5799face68699337fbb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\eca238d6-3697-43c7-980a-f81f295acd7c.vbs

Filesize
719B

MD5
fc2a8310573c5884d4c80ff2bae8f9ec

SHA1
a810c174a89a57a8ee8d5090a453fc9b191c6bd9

SHA256
b9fc6ae2fec24d5d1883b4817e08af1ba01dffc96caa1092ce0ed92f56feded8

SHA512
e1494008fa4056e3d5cd2fad05f17be02e2c688f0b5202b9d9a725a5fed807f5d4f83697f1de27f81ead48e65bec1280b3ec1e53953a47073692f17ca71ec49f

Download Submit
C:\Users\Admin\AppData\Local\Temp\fc4a9f83-5d8b-4f8c-8445-2655ccd9af9f.vbs

Filesize
719B

MD5
a77b9e9280d65264c43d9c0e54c17d34

SHA1
517d067cd8dc1dc0dd57766d3300b5c85ecf7886

SHA256
3ba246ca9c0dc8ea42963bdf85f75b0dfa96ad012080b10ef57687e62458ab4f

SHA512
dedfb7d2bd917962830de608b8832be6f94f19035f89435f602bb3cedf52bff30621a71479c762035b860e05fbd00371fc86b8b5eec519f31ae8299e75763ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\pWf3I9YR0J.bat

Filesize
208B

MD5
d57b077286f7844f89cf62b02a4ade58

SHA1
acb6022094967e560c5bcc565535295baf028d5b

SHA256
9409f8b3076daed05d2d670746e05317b7870d4e599d2c7036785d00dccbc28f

SHA512
ff4cc7d11d14274970af7b85cbc8188f0f70bb51b990d1806f0a41c4ccfdba472f902b133ecb5b8eb5091957e3a881ecbad0fd1caeea26b469ff85301b9de96e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp863A.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Public\Desktop\Registry.exe

Filesize
4.9MB

MD5
d38526128c39b9be768f702680a8345b

SHA1
b315d0373e8689816eb8b320b1a37b646ca090fc

SHA256
d5ba083e12a86c7498f46cf9de26e3ee23afff25f8cc1c6a5ba173bac98bd869

SHA512
98a0dc113ac897acf98722343a0c333e28b98baf58c2931773998cd1ea0b3d5c65964fa7b94c6f3769f1756b0cea366bd9e70af2ae2350c28c630d4a2f9f2dd1

Download Submit
memory/1108-172-0x000001E529EF0000-0x000001E529F12000-memory.dmp

Filesize
136KB

Download
memory/2256-281-0x000000001B980000-0x000000001B992000-memory.dmp

Filesize
72KB

Download
memory/3188-78-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3996-375-0x000000001B730000-0x000000001B742000-memory.dmp

Filesize
72KB

Download
memory/4768-11-0x000000001BEE0000-0x000000001BEF2000-memory.dmp

Filesize
72KB

Download
memory/4768-153-0x00007FF8D0500000-0x00007FF8D0FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4768-139-0x00007FF8D0503000-0x00007FF8D0505000-memory.dmp

Filesize
8KB

Download
memory/4768-18-0x000000001C090000-0x000000001C09C000-memory.dmp

Filesize
48KB

Download
memory/4768-17-0x000000001BF80000-0x000000001BF88000-memory.dmp

Filesize
32KB

Download
memory/4768-16-0x000000001BF70000-0x000000001BF78000-memory.dmp

Filesize
32KB

Download
memory/4768-14-0x000000001BF50000-0x000000001BF5E000-memory.dmp

Filesize
56KB

Download
memory/4768-15-0x000000001BF60000-0x000000001BF6E000-memory.dmp

Filesize
56KB

Download
memory/4768-13-0x000000001BEF0000-0x000000001BEFA000-memory.dmp

Filesize
40KB

Download
memory/4768-12-0x000000001C480000-0x000000001C9A8000-memory.dmp

Filesize
5.2MB

Download
memory/4768-0-0x00007FF8D0503000-0x00007FF8D0505000-memory.dmp

Filesize
8KB

Download
memory/4768-10-0x000000001BED0000-0x000000001BEDA000-memory.dmp

Filesize
40KB

Download
memory/4768-9-0x000000001B870000-0x000000001B880000-memory.dmp

Filesize
64KB

Download
memory/4768-8-0x000000001BEB0000-0x000000001BEC6000-memory.dmp

Filesize
88KB

Download
memory/4768-7-0x0000000002C00000-0x0000000002C10000-memory.dmp

Filesize
64KB

Download
memory/4768-6-0x00000000012E0000-0x00000000012E8000-memory.dmp

Filesize
32KB

Download
memory/4768-5-0x000000001BF00000-0x000000001BF50000-memory.dmp

Filesize
320KB

Download
memory/4768-4-0x000000001BE90000-0x000000001BEAC000-memory.dmp

Filesize
112KB

Download
memory/4768-3-0x000000001B740000-0x000000001B86E000-memory.dmp

Filesize
1.2MB

Download
memory/4768-2-0x00007FF8D0500000-0x00007FF8D0FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4768-1-0x00000000004F0000-0x00000000009E4000-memory.dmp

Filesize
5.0MB

Download