83fd2015a5499a8c2703d91aa047d0f099b85e8aa5ef9f2643a4eda4144a8772

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe

Disables Task Manager via registry modification
defense_evasion

Deletes itself 1 IoCs

pid	Process
2876	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2352	EofbViOjFpRS7hffLQht17dTG.exe

Loads dropped DLL 1 IoCs

pid	Process
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yi6joqUAg7OgBVikeHphsRKKG = "C:\\Windows\\system32\\n0OUC3BcrHzDMVyBPrplO7fOy\\EofbViOjFpRS7hffLQht17dTG.exe"	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
File opened for modification	C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
936	timeout.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2944	ipconfig.exe
932	ipconfig.exe
1964	ipconfig.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2916	schtasks.exe
1424	schtasks.exe
2820	schtasks.exe
1788	schtasks.exe
1188	schtasks.exe
1864	schtasks.exe
1820	schtasks.exe
2980	schtasks.exe
1880	schtasks.exe
2812	schtasks.exe
1520	schtasks.exe
2396	schtasks.exe
2208	schtasks.exe
2868	schtasks.exe
1608	schtasks.exe
2248	schtasks.exe
640	schtasks.exe
1708	schtasks.exe
2388	schtasks.exe
1480	schtasks.exe
876	schtasks.exe
344	schtasks.exe
2524	schtasks.exe
760	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2352	EofbViOjFpRS7hffLQht17dTG.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2852	powershell.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2352	EofbViOjFpRS7hffLQht17dTG.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
Token: SeDebugPrivilege	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeBackupPrivilege	2432	vssvc.exe
Token: SeRestorePrivilege	2432	vssvc.exe
Token: SeAuditPrivilege	2432	vssvc.exe
Token: SeDebugPrivilege	2352	EofbViOjFpRS7hffLQht17dTG.exe
Token: SeDebugPrivilege	2352	EofbViOjFpRS7hffLQht17dTG.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2944	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	31
PID 2500 wrote to memory of 2944	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	31
PID 2500 wrote to memory of 2944	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	31
PID 2500 wrote to memory of 2852	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	34
PID 2500 wrote to memory of 2852	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	34
PID 2500 wrote to memory of 2852	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	34
PID 2500 wrote to memory of 1520	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	40
PID 2500 wrote to memory of 1520	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	40
PID 2500 wrote to memory of 1520	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	40
PID 2500 wrote to memory of 2352	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	42
PID 2500 wrote to memory of 2352	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	42
PID 2500 wrote to memory of 2352	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	42
PID 2500 wrote to memory of 2876	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	43
PID 2500 wrote to memory of 2876	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	43
PID 2500 wrote to memory of 2876	2500	6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe	43
PID 2876 wrote to memory of 936	2876	cmd.exe	45
PID 2876 wrote to memory of 936	2876	cmd.exe	45
PID 2876 wrote to memory of 936	2876	cmd.exe	45
PID 2352 wrote to memory of 932	2352	EofbViOjFpRS7hffLQht17dTG.exe	46
PID 2352 wrote to memory of 932	2352	EofbViOjFpRS7hffLQht17dTG.exe	46
PID 2352 wrote to memory of 932	2352	EofbViOjFpRS7hffLQht17dTG.exe	46
PID 2352 wrote to memory of 1964	2352	EofbViOjFpRS7hffLQht17dTG.exe	48
PID 2352 wrote to memory of 1964	2352	EofbViOjFpRS7hffLQht17dTG.exe	48
PID 2352 wrote to memory of 1964	2352	EofbViOjFpRS7hffLQht17dTG.exe	48
PID 2352 wrote to memory of 2248	2352	EofbViOjFpRS7hffLQht17dTG.exe	50
PID 2352 wrote to memory of 2248	2352	EofbViOjFpRS7hffLQht17dTG.exe	50
PID 2352 wrote to memory of 2248	2352	EofbViOjFpRS7hffLQht17dTG.exe	50
PID 2352 wrote to memory of 344	2352	EofbViOjFpRS7hffLQht17dTG.exe	52
PID 2352 wrote to memory of 344	2352	EofbViOjFpRS7hffLQht17dTG.exe	52
PID 2352 wrote to memory of 344	2352	EofbViOjFpRS7hffLQht17dTG.exe	52
PID 2352 wrote to memory of 2820	2352	EofbViOjFpRS7hffLQht17dTG.exe	54
PID 2352 wrote to memory of 2820	2352	EofbViOjFpRS7hffLQht17dTG.exe	54
PID 2352 wrote to memory of 2820	2352	EofbViOjFpRS7hffLQht17dTG.exe	54
PID 2352 wrote to memory of 640	2352	EofbViOjFpRS7hffLQht17dTG.exe	56
PID 2352 wrote to memory of 640	2352	EofbViOjFpRS7hffLQht17dTG.exe	56
PID 2352 wrote to memory of 640	2352	EofbViOjFpRS7hffLQht17dTG.exe	56
PID 2352 wrote to memory of 1788	2352	EofbViOjFpRS7hffLQht17dTG.exe	58
PID 2352 wrote to memory of 1788	2352	EofbViOjFpRS7hffLQht17dTG.exe	58
PID 2352 wrote to memory of 1788	2352	EofbViOjFpRS7hffLQht17dTG.exe	58
PID 2352 wrote to memory of 1188	2352	EofbViOjFpRS7hffLQht17dTG.exe	60
PID 2352 wrote to memory of 1188	2352	EofbViOjFpRS7hffLQht17dTG.exe	60
PID 2352 wrote to memory of 1188	2352	EofbViOjFpRS7hffLQht17dTG.exe	60
PID 2352 wrote to memory of 1864	2352	EofbViOjFpRS7hffLQht17dTG.exe	62
PID 2352 wrote to memory of 1864	2352	EofbViOjFpRS7hffLQht17dTG.exe	62
PID 2352 wrote to memory of 1864	2352	EofbViOjFpRS7hffLQht17dTG.exe	62
PID 2352 wrote to memory of 2396	2352	EofbViOjFpRS7hffLQht17dTG.exe	64
PID 2352 wrote to memory of 2396	2352	EofbViOjFpRS7hffLQht17dTG.exe	64
PID 2352 wrote to memory of 2396	2352	EofbViOjFpRS7hffLQht17dTG.exe	64
PID 2352 wrote to memory of 2524	2352	EofbViOjFpRS7hffLQht17dTG.exe	66
PID 2352 wrote to memory of 2524	2352	EofbViOjFpRS7hffLQht17dTG.exe	66
PID 2352 wrote to memory of 2524	2352	EofbViOjFpRS7hffLQht17dTG.exe	66
PID 2352 wrote to memory of 2208	2352	EofbViOjFpRS7hffLQht17dTG.exe	68
PID 2352 wrote to memory of 2208	2352	EofbViOjFpRS7hffLQht17dTG.exe	68
PID 2352 wrote to memory of 2208	2352	EofbViOjFpRS7hffLQht17dTG.exe	68
PID 2352 wrote to memory of 2868	2352	EofbViOjFpRS7hffLQht17dTG.exe	71
PID 2352 wrote to memory of 2868	2352	EofbViOjFpRS7hffLQht17dTG.exe	71
PID 2352 wrote to memory of 2868	2352	EofbViOjFpRS7hffLQht17dTG.exe	71
PID 2352 wrote to memory of 1820	2352	EofbViOjFpRS7hffLQht17dTG.exe	73
PID 2352 wrote to memory of 1820	2352	EofbViOjFpRS7hffLQht17dTG.exe	73
PID 2352 wrote to memory of 1820	2352	EofbViOjFpRS7hffLQht17dTG.exe	73
PID 2352 wrote to memory of 2980	2352	EofbViOjFpRS7hffLQht17dTG.exe	75
PID 2352 wrote to memory of 2980	2352	EofbViOjFpRS7hffLQht17dTG.exe	75
PID 2352 wrote to memory of 2980	2352	EofbViOjFpRS7hffLQht17dTG.exe	75
PID 2352 wrote to memory of 760	2352	EofbViOjFpRS7hffLQht17dTG.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe
"C:\Users\Admin\AppData\Local\Temp\6aa340437e5bb3c895cbef7775c0694b2fa44692f995e85a64dca6e8f0e250c2.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\System32\ipconfig.exe
  "C:\Windows\System32\ipconfig.exe" /release
  2⤵
  - Gathers network information
  PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:08 /du 23:59 /sc daily /ri 1 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1520
- C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe
  "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\System32\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /release
    3⤵
    - Gathers network information
    PID:932
- - C:\Windows\System32\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /renew
    3⤵
    - Gathers network information
    PID:1964
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:08 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:08 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:344
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:08 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2820
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:09 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:640
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:09 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1788
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:09 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1188
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:09 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1864
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:09 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2396
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:09 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2524
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:09 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2208
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:09 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:09 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1820
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:09 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2980
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:10 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:760
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:10 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1708
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:10 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:10 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1480
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:10 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2916
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:10 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:876
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:10 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1880
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:10 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1608
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:10 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1424
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /create /tn Yi6joqUAg7OgBVikeHphsRKKG /tr "C:\Windows\system32\n0OUC3BcrHzDMVyBPrplO7fOy\EofbViOjFpRS7hffLQht17dTG.exe" /st 08:10 /du 23:59 /sc daily /ri 1 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6E4.tmp.bat""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\system32\timeout.exe
    timeout 6
    3⤵
    - Delays execution with timeout.exe
    PID:936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry