Overview
overview
10Static
static
10d4f7e0c033...35.exe
windows7-x64
10d4f7e0c033...35.exe
windows10-2004-x64
10d57a15943a...b8.exe
windows7-x64
10d57a15943a...b8.exe
windows10-2004-x64
10d5b7e88e91...31.exe
windows7-x64
5d5b7e88e91...31.exe
windows10-2004-x64
5d5b9cbc990...bf.exe
windows7-x64
7d5b9cbc990...bf.exe
windows10-2004-x64
7d5bce0b9b1...56.exe
windows7-x64
10d5bce0b9b1...56.exe
windows10-2004-x64
10d5fc43e4e1...1f.exe
windows7-x64
1d5fc43e4e1...1f.exe
windows10-2004-x64
1d61876dded...d3.exe
windows7-x64
10d61876dded...d3.exe
windows10-2004-x64
10d61b23d4ac...e0.exe
windows7-x64
10d61b23d4ac...e0.exe
windows10-2004-x64
10d690267038...3a.exe
windows7-x64
8d690267038...3a.exe
windows10-2004-x64
8d6995ab53a...3c.exe
windows7-x64
10d6995ab53a...3c.exe
windows10-2004-x64
10d6a9816b0d...9f.exe
windows7-x64
1d6a9816b0d...9f.exe
windows10-2004-x64
1d6e2e28870...ca.exe
windows7-x64
10d6e2e28870...ca.exe
windows10-2004-x64
10d70550d5d4...cd.exe
windows7-x64
10d70550d5d4...cd.exe
windows10-2004-x64
10d72c4b8c14...db.exe
windows7-x64
7d72c4b8c14...db.exe
windows10-2004-x64
7d735d6b2f3...86.exe
windows7-x64
10d735d6b2f3...86.exe
windows10-2004-x64
10d7508b0790...b3.exe
windows7-x64
10d7508b0790...b3.exe
windows10-2004-x64
10Analysis
-
max time kernel
122s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:17
Behavioral task
behavioral1
Sample
d4f7e0c033fa7006a593674e3052cc35.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d4f7e0c033fa7006a593674e3052cc35.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
d57a15943ae8a9e653d5a6c6870271b8.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
d57a15943ae8a9e653d5a6c6870271b8.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral5
Sample
d5b7e88e919915c58afbaad1d7cb2531.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
d5b7e88e919915c58afbaad1d7cb2531.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
d5b9cbc990cc88135ff80a41945ea3c940b8726e286812fbf402dbf5f2f66bbf.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
d5b9cbc990cc88135ff80a41945ea3c940b8726e286812fbf402dbf5f2f66bbf.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
d5bce0b9b1bfbe56a03cf54d9beb1a2a2e485beccb72393148e209ae63fb8556.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
d5bce0b9b1bfbe56a03cf54d9beb1a2a2e485beccb72393148e209ae63fb8556.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
d5fc43e4e1fb229c3f946ac0417a0a630b0809b33a2f1bacc7b81f45006fbf1f.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
d5fc43e4e1fb229c3f946ac0417a0a630b0809b33a2f1bacc7b81f45006fbf1f.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
d61876ddede62df51f22178f3f3810d3.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
d61876ddede62df51f22178f3f3810d3.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
d61b23d4acf185dc6322a40c7f0f56e0.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
d61b23d4acf185dc6322a40c7f0f56e0.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
d690267038d2a718d56558e839b2613a.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
d690267038d2a718d56558e839b2613a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
d6a9816b0df03fee5229e490ff3bfa2a016c0eeb9658b09fd6538a34e469579f.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
d6a9816b0df03fee5229e490ff3bfa2a016c0eeb9658b09fd6538a34e469579f.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
d6e2e288705c6ca37ed2968b4ff7e7ca.exe
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
d6e2e288705c6ca37ed2968b4ff7e7ca.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
d70550d5d46716704be759d325b3a8f0047905a4f170abe251491f13b3a563cd.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
d70550d5d46716704be759d325b3a8f0047905a4f170abe251491f13b3a563cd.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
d735d6b2f34e9a7cd2604d3036ac8486.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
d735d6b2f34e9a7cd2604d3036ac8486.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
d7508b07903325957294ebdcb89bd5b3.exe
Resource
win7-20241023-en
Behavioral task
behavioral32
Sample
d7508b07903325957294ebdcb89bd5b3.exe
Resource
win10v2004-20250314-en
General
-
Target
d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe
-
Size
1.9MB
-
MD5
733112fa2d9d15aaff3659ea9e2d3b4c
-
SHA1
85a535c82f3f869fd52b0199b2ef4cbddb979c68
-
SHA256
d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c
-
SHA512
74b123f9717bc2a49ff9a814e441a54c4b2d9969ec30cbb692927bd10e93884237b6f8cbf87480bab76ec7835ee5661baa9d06e56887ac3ab530b366efe04c25
-
SSDEEP
24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD
Malware Config
Signatures
-
Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4092 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4368 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2212 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1244 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3056 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4516 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4860 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4520 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3684 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3812 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4836 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 436 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4908 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5076 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3828 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3312 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4812 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 760 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1592 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1980 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1380 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3028 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2432 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2532 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2140 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 888 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1560 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3448 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1616 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2196 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3596 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 928 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 448 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 392 4296 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2052 4296 schtasks.exe 88 -
UAC bypass 3 TTPs 33 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1464 powershell.exe 3088 powershell.exe 3596 powershell.exe 1904 powershell.exe 1292 powershell.exe 2100 powershell.exe 3040 powershell.exe 4736 powershell.exe 1924 powershell.exe 2000 powershell.exe 4424 powershell.exe 996 powershell.exe 4836 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe -
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation SppExtComObj.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation SppExtComObj.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation SppExtComObj.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation SppExtComObj.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation SppExtComObj.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation SppExtComObj.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation SppExtComObj.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation SppExtComObj.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation SppExtComObj.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation SppExtComObj.exe -
Executes dropped EXE 10 IoCs
pid Process 5164 SppExtComObj.exe 5836 SppExtComObj.exe 1236 SppExtComObj.exe 624 SppExtComObj.exe 3664 SppExtComObj.exe 5304 SppExtComObj.exe 4704 SppExtComObj.exe 4688 SppExtComObj.exe 552 SppExtComObj.exe 1768 SppExtComObj.exe -
Checks whether UAC is enabled 1 TTPs 22 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SppExtComObj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SppExtComObj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SppExtComObj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SppExtComObj.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\RCX9030.tmp d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\RCX909E.tmp d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\SppExtComObj.exe d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File opened for modification C:\Program Files\dotnet\swidtag\RCX9A1C.tmp d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File opened for modification C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File created C:\Program Files (x86)\Google\GoogleUpdater\e1ef82546f0b02 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File created C:\Program Files\dotnet\swidtag\eddb19405b7ce1 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File opened for modification C:\Program Files\dotnet\swidtag\RCX9A0C.tmp d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File created C:\Program Files (x86)\Google\GoogleUpdater\SppExtComObj.exe d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\System\RuntimeBroker.exe d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File opened for modification C:\Windows\System\RuntimeBroker.exe d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File created C:\Windows\System\9e8d7a4ca61bd9 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File created C:\Windows\servicing\es-ES\StartMenuExperienceHost.exe d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File opened for modification C:\Windows\System\RCX8B98.tmp d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe File opened for modification C:\Windows\System\RCX8B99.tmp d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings SppExtComObj.exe Key created \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings SppExtComObj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe Key created \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings SppExtComObj.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3812 schtasks.exe 3828 schtasks.exe 1980 schtasks.exe 928 schtasks.exe 4516 schtasks.exe 4520 schtasks.exe 2212 schtasks.exe 3684 schtasks.exe 1380 schtasks.exe 392 schtasks.exe 1244 schtasks.exe 4836 schtasks.exe 436 schtasks.exe 2532 schtasks.exe 1616 schtasks.exe 4368 schtasks.exe 3056 schtasks.exe 3312 schtasks.exe 2140 schtasks.exe 4908 schtasks.exe 760 schtasks.exe 3028 schtasks.exe 2432 schtasks.exe 2644 schtasks.exe 888 schtasks.exe 3448 schtasks.exe 4092 schtasks.exe 4860 schtasks.exe 5076 schtasks.exe 4812 schtasks.exe 2196 schtasks.exe 2052 schtasks.exe 1592 schtasks.exe 1560 schtasks.exe 3596 schtasks.exe 448 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 1904 powershell.exe 1904 powershell.exe 4836 powershell.exe 4836 powershell.exe 3596 powershell.exe 3596 powershell.exe 4424 powershell.exe 4424 powershell.exe 4736 powershell.exe 4736 powershell.exe 996 powershell.exe 996 powershell.exe 1292 powershell.exe 1292 powershell.exe 3040 powershell.exe 3040 powershell.exe 4424 powershell.exe 1924 powershell.exe 1924 powershell.exe 1464 powershell.exe 1464 powershell.exe 2000 powershell.exe 2000 powershell.exe 3088 powershell.exe 3088 powershell.exe 2100 powershell.exe 2100 powershell.exe 996 powershell.exe 4836 powershell.exe 3596 powershell.exe 3040 powershell.exe 1904 powershell.exe 1904 powershell.exe 3088 powershell.exe 2100 powershell.exe 4736 powershell.exe 1464 powershell.exe 2000 powershell.exe 1292 powershell.exe 1924 powershell.exe 5164 SppExtComObj.exe 5164 SppExtComObj.exe 5836 SppExtComObj.exe 1236 SppExtComObj.exe 1236 SppExtComObj.exe 624 SppExtComObj.exe 3664 SppExtComObj.exe 5304 SppExtComObj.exe 4704 SppExtComObj.exe 4688 SppExtComObj.exe 552 SppExtComObj.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe Token: SeDebugPrivilege 3596 powershell.exe Token: SeDebugPrivilege 1904 powershell.exe Token: SeDebugPrivilege 4836 powershell.exe Token: SeDebugPrivilege 4424 powershell.exe Token: SeDebugPrivilege 4736 powershell.exe Token: SeDebugPrivilege 3088 powershell.exe Token: SeDebugPrivilege 996 powershell.exe Token: SeDebugPrivilege 1292 powershell.exe Token: SeDebugPrivilege 2100 powershell.exe Token: SeDebugPrivilege 3040 powershell.exe Token: SeDebugPrivilege 1924 powershell.exe Token: SeDebugPrivilege 1464 powershell.exe Token: SeDebugPrivilege 2000 powershell.exe Token: SeDebugPrivilege 5164 SppExtComObj.exe Token: SeDebugPrivilege 5836 SppExtComObj.exe Token: SeDebugPrivilege 1236 SppExtComObj.exe Token: SeDebugPrivilege 624 SppExtComObj.exe Token: SeDebugPrivilege 3664 SppExtComObj.exe Token: SeDebugPrivilege 5304 SppExtComObj.exe Token: SeDebugPrivilege 4704 SppExtComObj.exe Token: SeDebugPrivilege 4688 SppExtComObj.exe Token: SeDebugPrivilege 552 SppExtComObj.exe Token: SeDebugPrivilege 1768 SppExtComObj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4764 wrote to memory of 3596 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 129 PID 4764 wrote to memory of 3596 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 129 PID 4764 wrote to memory of 1904 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 130 PID 4764 wrote to memory of 1904 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 130 PID 4764 wrote to memory of 1292 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 131 PID 4764 wrote to memory of 1292 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 131 PID 4764 wrote to memory of 2100 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 132 PID 4764 wrote to memory of 2100 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 132 PID 4764 wrote to memory of 3040 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 133 PID 4764 wrote to memory of 3040 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 133 PID 4764 wrote to memory of 4736 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 134 PID 4764 wrote to memory of 4736 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 134 PID 4764 wrote to memory of 1924 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 135 PID 4764 wrote to memory of 1924 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 135 PID 4764 wrote to memory of 3088 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 136 PID 4764 wrote to memory of 3088 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 136 PID 4764 wrote to memory of 1464 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 137 PID 4764 wrote to memory of 1464 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 137 PID 4764 wrote to memory of 2000 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 138 PID 4764 wrote to memory of 2000 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 138 PID 4764 wrote to memory of 4836 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 139 PID 4764 wrote to memory of 4836 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 139 PID 4764 wrote to memory of 996 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 140 PID 4764 wrote to memory of 996 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 140 PID 4764 wrote to memory of 4424 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 141 PID 4764 wrote to memory of 4424 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 141 PID 4764 wrote to memory of 5164 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 156 PID 4764 wrote to memory of 5164 4764 d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe 156 PID 5164 wrote to memory of 5560 5164 SppExtComObj.exe 157 PID 5164 wrote to memory of 5560 5164 SppExtComObj.exe 157 PID 5164 wrote to memory of 5608 5164 SppExtComObj.exe 158 PID 5164 wrote to memory of 5608 5164 SppExtComObj.exe 158 PID 5560 wrote to memory of 5836 5560 WScript.exe 160 PID 5560 wrote to memory of 5836 5560 WScript.exe 160 PID 5836 wrote to memory of 5976 5836 SppExtComObj.exe 161 PID 5836 wrote to memory of 5976 5836 SppExtComObj.exe 161 PID 5836 wrote to memory of 6024 5836 SppExtComObj.exe 162 PID 5836 wrote to memory of 6024 5836 SppExtComObj.exe 162 PID 5976 wrote to memory of 1236 5976 WScript.exe 166 PID 5976 wrote to memory of 1236 5976 WScript.exe 166 PID 1236 wrote to memory of 5416 1236 SppExtComObj.exe 169 PID 1236 wrote to memory of 5416 1236 SppExtComObj.exe 169 PID 1236 wrote to memory of 4100 1236 SppExtComObj.exe 170 PID 1236 wrote to memory of 4100 1236 SppExtComObj.exe 170 PID 5416 wrote to memory of 624 5416 WScript.exe 174 PID 5416 wrote to memory of 624 5416 WScript.exe 174 PID 624 wrote to memory of 4316 624 SppExtComObj.exe 175 PID 624 wrote to memory of 4316 624 SppExtComObj.exe 175 PID 624 wrote to memory of 4616 624 SppExtComObj.exe 176 PID 624 wrote to memory of 4616 624 SppExtComObj.exe 176 PID 4316 wrote to memory of 3664 4316 WScript.exe 177 PID 4316 wrote to memory of 3664 4316 WScript.exe 177 PID 3664 wrote to memory of 244 3664 SppExtComObj.exe 178 PID 3664 wrote to memory of 244 3664 SppExtComObj.exe 178 PID 3664 wrote to memory of 5476 3664 SppExtComObj.exe 179 PID 3664 wrote to memory of 5476 3664 SppExtComObj.exe 179 PID 244 wrote to memory of 5304 244 WScript.exe 181 PID 244 wrote to memory of 5304 244 WScript.exe 181 PID 5304 wrote to memory of 5900 5304 SppExtComObj.exe 182 PID 5304 wrote to memory of 5900 5304 SppExtComObj.exe 182 PID 5304 wrote to memory of 5996 5304 SppExtComObj.exe 183 PID 5304 wrote to memory of 5996 5304 SppExtComObj.exe 183 PID 5900 wrote to memory of 4704 5900 WScript.exe 184 PID 5900 wrote to memory of 4704 5900 WScript.exe 184 -
System policy modification 1 TTPs 33 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SppExtComObj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SppExtComObj.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe"C:\Users\Admin\AppData\Local\Temp\d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe"1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4764 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3596
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\csrss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\GoogleUpdater\SppExtComObj.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sysmon.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\csrss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\OfficeClickToRun.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\TextInputHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe"C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5164 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d6ff011-e075-4179-b436-bf370ff87283.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exeC:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5836 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad603efc-0941-4534-bd4d-a2aba0c2d100.vbs"5⤵
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exeC:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1236 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6bb8bfe-652b-41bb-ae4a-b0a9065e1840.vbs"7⤵
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exeC:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:624 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1ccc58f-9334-41bc-bd71-71bdfe52af7b.vbs"9⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exeC:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3664 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28233ca1-9248-4027-b255-998af893ac50.vbs"11⤵
- Suspicious use of WriteProcessMemory
PID:244 -
C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exeC:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5304 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\949b1638-7107-490d-a6e3-fbbcfb6337e4.vbs"13⤵
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exeC:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4704 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\435de542-e9db-488e-b40a-4072c5559d8c.vbs"15⤵PID:5124
-
C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exeC:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4688 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2b2fc13-be16-4048-a9f2-10fdc621403a.vbs"17⤵PID:5360
-
C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exeC:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:552 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db74e4e3-0eb2-480c-91b6-b3752dfe6e67.vbs"19⤵PID:4788
-
C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exeC:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1768 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4585f444-99ea-48f9-a0bc-7a8ff9f68e11.vbs"21⤵PID:3076
-
C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exeC:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe22⤵PID:4164
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc5af159-c714-4565-8bda-bd5f7c2a1645.vbs"23⤵PID:4580
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04a33bd1-2f7f-49fd-9361-a081a2888f96.vbs"23⤵PID:5452
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aaa8e9aa-3afe-4904-8ea3-724d88f001aa.vbs"21⤵PID:1344
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3074a974-ffb9-43c7-bab1-70593d5226b1.vbs"19⤵PID:1656
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7dffc387-2dc0-46c1-8fe6-800fd711ac22.vbs"17⤵PID:2316
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c84669fe-f823-49d5-ac21-767c7f58b93a.vbs"15⤵PID:5980
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f8a2168-ce90-4dd8-ada9-4a482f2d06f9.vbs"13⤵PID:5996
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31d0f224-d37c-4d2f-a1ec-423401cef187.vbs"11⤵PID:5476
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72387453-7dd1-4eb9-a33b-963105d97cf7.vbs"9⤵PID:4616
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6f3df8d-a811-41db-bb15-9e9226f576e6.vbs"7⤵PID:4100
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10822913-b100-47d4-bfe6-9aa9c9597635.vbs"5⤵PID:6024
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19019f6f-1380-4f1a-99b3-bde9579b5598.vbs"3⤵PID:5608
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\System\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\System\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\3ac54ddf2ad44faa6035cf\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\3ac54ddf2ad44faa6035cf\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\GoogleUpdater\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\GoogleUpdater\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\GoogleUpdater\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\SendTo\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default\SendTo\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\3ac54ddf2ad44faa6035cf\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\3ac54ddf2ad44faa6035cf\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5b7671ba040418a6d41606fe186576d5e
SHA1f364635d7cde26d2a2d2e345f11f8f49d7acd8ee
SHA256f2505b5c55e6bf953df04096972909a62e58692c6bd6547ba18e817342589aa2
SHA5122bfc1aa3c2c1373ff328c8c37a1d28e56b300cde76740732bc0ebdd8bd9d89a4c5b3bf3b0be015f8882c3e1c4752c691e594e79af9bf8dc412838cb468c853cb
-
Filesize
1.9MB
MD50cb82368cebf38e80f397ea3de2c0cf5
SHA1b0f0cfab3af4723037e7e73c627635741b3e2c1d
SHA25660a156167b3a3a7c32e3586895af3b4c975ab80fe31ac217410c2420eaf94a1e
SHA5128f8215bdea4a8af8df18900dcee1976e3147c6f1aeb1759292dc29c6c1cbf8ab8df78008dac50cb7fc53ee691e8b647af149e1e130d64a52ed7bed0e508ca6d2
-
Filesize
1.9MB
MD5733112fa2d9d15aaff3659ea9e2d3b4c
SHA185a535c82f3f869fd52b0199b2ef4cbddb979c68
SHA256d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c
SHA51274b123f9717bc2a49ff9a814e441a54c4b2d9969ec30cbb692927bd10e93884237b6f8cbf87480bab76ec7835ee5661baa9d06e56887ac3ab530b366efe04c25
-
Filesize
1KB
MD5364147c1feef3565925ea5b4ac701a01
SHA19a46393ac3ffad3bb3c8f0e074b65d68d75e21ef
SHA25638cf1ab1146ad24e88763fc0508c2a99478d8428b453ba8c8b830d2883a4562b
SHA512bfec1d3f22abd5668def189259deb4d919ceb4d51ac965d0baf9b6cf8bea0db680d49a2b8d0b75524cc04c7803cdfd91e484b31dc8ddc3ff47d1e5c59a9e35cf
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cae19674c4dd6a419a8ce8bc65e65167
SHA18b3f7e010483412b803e756c850fecd29cf9fb8a
SHA256f4a34d2ff32e49df841e87405dab2661bcae83c20ee781a13fbe73924fd672cd
SHA5129865dd43b4494081bb625844fcedb56dfc335b5f2cadd5c4094f0848df07ab5fa40faeb3adbbb91e1355ed436dfbf44ff4ae9ad39cdbd5fbfdef4d1813f3ee74
-
Filesize
944B
MD5a16aff60eb3c3e35753a259b050c8a27
SHA185196d5dfb23d0c8b32b186325e2d58315a11287
SHA256a057f85fa5358fac25f1337c1fbabeffb1ca1908b352208038293ec575dfc206
SHA51213e6514cddaafba8f4fe3b08f6d6e118823ad454aac4efcb71a82438de50f97cd9570f44d594db27e4c534912a12ed066ea098b95505a6994f854f8349f2f5b0
-
Filesize
944B
MD5acb0e0db180c73954955309f90c91376
SHA1c27f2c17cfa4fd4a92174eb548aacf6606814cf4
SHA25610c4266a001dde473f229f0ad24a3ba938d703f7c80debe52f6f49d3441cc849
SHA5126fffb653f2da467d9d0cec17d2a39c6bd89321c5193a093547f20af70f7f74800045273860165543779a9298c9bbace104f8710bc1557ff9a31d6cbec3a298fc
-
Filesize
944B
MD5d2e14ffaec8328ef6b85925ed5fc2c9b
SHA1f42699edcf4fea12a6f3301141f996c2b8ecaf5d
SHA256a75bb133d71f078fb9d5fa46ae46b5d23bfaacd382b0dadb4da59567f6749ccd
SHA512335a0c6e8a6b1620b5644962c7deb43cef5e5ecb7f4d84816671cac12bd42d2fd6311e1c6ebe9c3a9bf5bc49c170760ba42d7045a74a38ec0963badacd72beff
-
Filesize
944B
MD5efd2dfedf7e67764ce4dc0c1475d5543
SHA1be775a500ecf6c234153afad0b8ec07e56ad74fa
SHA256662c4f869810ea7f43ce3ccbeccc5b80c443161c56a346fb9054fb1fa613a7ad
SHA512b167fa92f6d63b18e6247445b1c532a2a229a0fc6dcd26c9d1526749f80c7ec01524b7ce497ab94a3df814f9ce4b7394d872d85555323ddcd08798d565f3211e
-
Filesize
944B
MD53fe089fecc1a7897c40a12707d788ca9
SHA197f8ab9020333729ec191b3dbd044c57227b84fc
SHA25670d80df3a3a68fa45dd114205f58cc05df07e22940ec0f0f6172abfccf671e7c
SHA5124e4feebea709ed3bbfd82ed507d04566593e9cb7bb02ca1056d8ecb6cbcd3b5118be5dee4ee80bf158565a009c05b217bd4c885fb1e01c7d61f5e3d430c940cb
-
Filesize
944B
MD5fd95e4475b8798a58a9e9d19409c1eac
SHA1571d070dd6315847c4ba334670beffd245a35c45
SHA256d33812e9c83075812c904e8ea736f744d614cb597e4c7aa4420021e492390729
SHA5121ad95b0411ffbdeff090c3c71000377027095ecbc8ad27d9b4c8b7b469e669f7d76cd13f7ab2012779b6ac12c5ff2671f4e44fa8d1f2aefae3824ed74a9fa7fe
-
Filesize
494B
MD5c5254709b44942f657b44ff3dc64dfa6
SHA14fef6820a0e0843e11cb32dacc88ca3679d14f69
SHA25688632635b864a5ffc3efde4b3915b0fd37eb090685ba90666245358c28399b3d
SHA5124632e78b1595b42c6fc05adb3c6b0442d4f04497ea0ad02a8f6d03d2bdb3f7d950a3f7a33d1bf7e3c9b219937ccb08d79bdbcbf5fb1d436cb5a0e29b058d9102
-
Filesize
718B
MD5e00c235924685adddf858eb05812c47a
SHA14fbd79a022c848b869c3930b00a75fceba397138
SHA2562224ec678b9e94abcacec9f4bb3c3634a4f2a1f6c908bbb9155e2fb8fd2ca359
SHA51213e97914f1917284aa579c9657c92b97bdad7b5e58c43a869d4ac62f58edf7341403de9bd57235818a2ee0038552b3129ae4ba9de23d83e113b8d805e188cbfa
-
Filesize
718B
MD5294f8b3affc22487f43ce31418c86e26
SHA1e2a2414412bf9b4ba3f3a0437228fc4372b33a65
SHA2564c4b21f9087d4c544a712a5a63d46e12260974b01f003f222bc6398671a28699
SHA512ce2c15cef2008bdbca030499f1350507a9aafa949855d411a0a3059fc96352533bfa863fbe19e98ec1dc18250271545a011cc3ef207e01911120fc33f8442afc
-
Filesize
718B
MD5ebd89f3050c8ea255a78c1160f425c77
SHA18b9355c40acc899296ccdb36d9d04da02f9f4ba8
SHA2560c3e24c9bb85a3a0b1d602a1874221784b180eeb09abb7d31a2634948a0d4cbf
SHA5121e1fbbb27c6bf2a2d5a1224668b8701d740f7c2b1bb3e981bfc2aaf49f32c1c341617bb310eedd6a3838bfd5be4fc8a5928e5c6a175c537562572e3e403aa94b
-
Filesize
718B
MD5fb51c719006253502344f98d932834de
SHA1c8dda6ebe7ac3154cde4fa29e79c09f632aae62c
SHA25647254968d0b0c6e6503b0e1612d6d74d69a31a8bf7f22280faae6e2f50e7127a
SHA512cae9aa24e260231df458670fb9c69ba68f44d04785f17740ddfa3ba3da7a0bc25cb57f0fc180977e3986888454bce15b79fb27124793c4d1272a8cad8745ac8d
-
Filesize
718B
MD5e515b12cfa37a2c0e81976e2d7957fe8
SHA111d8391209bdc0036cc32ac00b4303ffd105f82e
SHA2568c2f0522f6ec8ef4bfa2867724a57395726b71bae464f30f491f1918494af8f0
SHA51224b639c5833ee8936291b5e7df1a17eed22e45e0c6499e5b1fc1ff677b8ba72b02ef76107e2ee7d4cba57916fc6fffe232bc36a3c9cc5d9e158b562b06745219
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
718B
MD565583dc5e30e2e3eb43b02f273bcc837
SHA1f39abc246bb847e343494211f309c8cdc105ba85
SHA25689334d6823b3e66aa7f6fc7478149ca07fd43ea69f511ea344a438a5e20228a5
SHA5122fdea079ec36cddb5bebab5d7d8604bbadd24a88d01051fa36bbe11ed0abf387db4fc5e381ae3b9e26bd32835ad7af06e403383e7acdd7336bc7241258a9106f
-
Filesize
718B
MD5c0aee1b177c1e1e4d1d83eda706606de
SHA10c6cab4a992400ce700596d697292a5e83ef066a
SHA25637f53707050afdfb87629f45c16da1fc48996e41d81436ddd6ccd96704b9362a
SHA5123695247b45cc9792aaa4db12c02361caeb853f0515188f9993ded6db0799941f6a7eaebbda59e6a96c7b8740af21aaf689ae0a1cfc536c99f846c1b6f0cc75f9
-
Filesize
717B
MD586ecb49736bdf85e326560d22a4f089f
SHA1b3b369e5f620e0894b36471f2a93192e36136f9d
SHA2566f1d96450b0df461fd6086341f73e8018f945813738a2b3f564083122e44c416
SHA512e010030aa5380526523c9424a4249a778c590c282c2421aaf02be6a42c1b735b5d1caf90fb0f3c77f04bdfc414821d363d22ab3f404cbc342cccc39960ca5843
-
Filesize
718B
MD5a8f3856478c2f8e50da3747730ec108a
SHA168a76ccc4a35bd89f928ebb2126cd38c7e03302c
SHA256ad0bc37056bedd8ee303a6234898c86d943528c0efe6a6e99d15a36375415573
SHA51220839993c7eeeacf91b6fa7170ce2893a26bdbae3373572cf1975bbc6841c5369a09a13445bc85062eee638ff0b07e2ec5fe96db3368d3a65a6629f29bca3423
-
Filesize
717B
MD54b111d3a01bdcc94f44202d2f775ba52
SHA111a65f7becd3013cbbd29250220a033866821a86
SHA2566d38632f071a3f53ead31fd996a01d81dc74f128e44cd6ccd1b8b2e1e87c0e33
SHA512edfcd6898a834b158d4135b016583e48b49ca83beb41ca7c43622ac62affe5d25051c038eac571c2629f98ec1d139bf242a279c29ac76572266f0590b5520878
-
Filesize
718B
MD524874012ba1015d7afcf1916aebea071
SHA1e6af8f99a031e287ebfb1009c0e1910d1ac9b2e5
SHA25642e4f267a439888a762749379f99d36391582e9efaf4524eb82231b5e679c32e
SHA512866e6e44052f820ef1dfa91d3e598505d653c2670a8d119eb1eda18d7af155231b3e10e33f9ebb776f8b3d4c40190935e31a95843b7c0830a8b4f76eace8f33f