quasar | 4f872140210a9253c0deb66a65f0c265a194e85d99a639f406d927a1ac760903

pid	Process
5036	schtasks.exe
1756	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4112	FlashingSoftwarePRO.exe
Token: SeDebugPrivilege	3912	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3912	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 5036	4112	FlashingSoftwarePRO.exe	84
PID 4112 wrote to memory of 5036	4112	FlashingSoftwarePRO.exe	84
PID 4112 wrote to memory of 3912	4112	FlashingSoftwarePRO.exe	86
PID 4112 wrote to memory of 3912	4112	FlashingSoftwarePRO.exe	86
PID 3912 wrote to memory of 1756	3912	svchost.exe	87
PID 3912 wrote to memory of 1756	3912	svchost.exe	87
PID 3912 wrote to memory of 4764	3912	svchost.exe	98
PID 3912 wrote to memory of 4764	3912	svchost.exe	98
PID 3912 wrote to memory of 4672	3912	svchost.exe	100
PID 3912 wrote to memory of 4672	3912	svchost.exe	100
PID 4672 wrote to memory of 3668	4672	cmd.exe	102
PID 4672 wrote to memory of 3668	4672	cmd.exe	102
PID 4672 wrote to memory of 4368	4672	cmd.exe	103
PID 4672 wrote to memory of 4368	4672	cmd.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FlashingSoftwarePRO.exe
"C:\Users\Admin\AppData\Local\Temp\FlashingSoftwarePRO.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\System32\svchost.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5036
- C:\Windows\system32\System32\svchost.exe
  "C:\Windows\system32\System32\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\System32\svchost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1756
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /delete /tn "RuntimeBroker" /f
    3⤵
    PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PVfbMJtMSePo.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3668
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service