e9e6a5e4d64f01b158801bbaead6aedfeeb8cd754e734d1471f591ca3e2c08f8

Analysis

max time kernel
77s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Size 1.9MB
Sample250322-g17rssy1ev
SHA256 d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea
MD5 371ac901265784870ebce3b2f6d4c663
SHA1 624369382a311fd84568a61b309f8414b8ca7c07
SHA512 28a83331b901295d597616364a429020e7879aaa1abb5c690e98bd96f385a8ed5dbe27435c94d525a678c4cc4e3c6228f00fa5356828ec53b540ac67def51d27
SSDEEP 24576:Uz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:UOMX0/08SVYTcxMXPxthD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	3008	schtasks.exe	30

UAC bypass 3 TTPs 21 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2296	powershell.exe
2140	powershell.exe
1376	powershell.exe
1856	powershell.exe
1356	powershell.exe
2176	powershell.exe
2504	powershell.exe
2612	powershell.exe
2760	powershell.exe
1084	powershell.exe
928	powershell.exe
2836	powershell.exe
1364	powershell.exe
1968	powershell.exe
1776	powershell.exe
284	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe

Executes dropped EXE 6 IoCs

pid	Process
2820	csrss.exe
2728	csrss.exe
912	csrss.exe
2768	csrss.exe
808	csrss.exe
2604	csrss.exe

Checks whether UAC is enabled 1 TTPs 14 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\24dbde2999530e	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files\Google\Chrome\sppsvc.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\24dbde2999530e	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\RCXCE60.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\RCXBCE1.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\RCXC0EC.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Google\Chrome\sppsvc.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\RCXC2F1.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\6203df4a6bafc7	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\1610b97d3ab4a7	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Windows Defender\RCXB666.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Google\Chrome\RCXB8D9.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\RCXC0EB.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Windows Defender\explorer.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files\Windows Defender\7a0fd90576e088	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files\Google\Chrome\0a1fd5f707cd16	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\886983d96e3d3e	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\RCXBCE2.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Windows Defender\RCXB6D4.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Google\Chrome\RCXB8D8.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\RCXCDF2.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files\Windows Defender\explorer.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\RCXC2F0.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\RCXC4F5.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\RCXC563.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ShellNew\RCXD558.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Windows\ShellNew\winlogon.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Windows\de-DE\42af1c969fbb7b	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Windows\ShellNew\cc11b995f2a76d	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Windows\de-DE\RCXC9E8.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Windows\de-DE\audiodg.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Windows\de-DE\audiodg.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Windows\ShellNew\winlogon.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Windows\de-DE\RCXC9E9.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Windows\ShellNew\RCXD4EA.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2348	schtasks.exe
2756	schtasks.exe
2004	schtasks.exe
2084	schtasks.exe
1868	schtasks.exe
2984	schtasks.exe
2952	schtasks.exe
592	schtasks.exe
2844	schtasks.exe
2872	schtasks.exe
2940	schtasks.exe
2792	schtasks.exe
1564	schtasks.exe
1712	schtasks.exe
2128	schtasks.exe
980	schtasks.exe
2624	schtasks.exe
2476	schtasks.exe
1924	schtasks.exe
2812	schtasks.exe
2608	schtasks.exe
944	schtasks.exe
900	schtasks.exe
2948	schtasks.exe
316	schtasks.exe
2076	schtasks.exe
1832	schtasks.exe
1652	schtasks.exe
2820	schtasks.exe
2204	schtasks.exe
3044	schtasks.exe
2184	schtasks.exe
2968	schtasks.exe
2468	schtasks.exe
1676	schtasks.exe
692	schtasks.exe
2308	schtasks.exe
2432	schtasks.exe
2052	schtasks.exe
2828	schtasks.exe
2148	schtasks.exe
2720	schtasks.exe
2956	schtasks.exe
1632	schtasks.exe
2588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
2760	powershell.exe
284	powershell.exe
1376	powershell.exe
1084	powershell.exe
2504	powershell.exe
2836	powershell.exe
2612	powershell.exe
1968	powershell.exe
1856	powershell.exe
2140	powershell.exe
1776	powershell.exe
2296	powershell.exe
1356	powershell.exe
1364	powershell.exe
2176	powershell.exe
928	powershell.exe
2820	csrss.exe
2728	csrss.exe
912	csrss.exe
2768	csrss.exe
808	csrss.exe
2604	csrss.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Token: SeDebugPrivilege	2820	csrss.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	284	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	2728	csrss.exe
Token: SeDebugPrivilege	912	csrss.exe
Token: SeDebugPrivilege	2768	csrss.exe
Token: SeDebugPrivilege	808	csrss.exe
Token: SeDebugPrivilege	2604	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1856	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	77
PID 2672 wrote to memory of 1856	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	77
PID 2672 wrote to memory of 1856	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	77
PID 2672 wrote to memory of 1968	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	78
PID 2672 wrote to memory of 1968	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	78
PID 2672 wrote to memory of 1968	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	78
PID 2672 wrote to memory of 2612	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	79
PID 2672 wrote to memory of 2612	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	79
PID 2672 wrote to memory of 2612	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	79
PID 2672 wrote to memory of 2760	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	80
PID 2672 wrote to memory of 2760	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	80
PID 2672 wrote to memory of 2760	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	80
PID 2672 wrote to memory of 1356	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	81
PID 2672 wrote to memory of 1356	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	81
PID 2672 wrote to memory of 1356	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	81
PID 2672 wrote to memory of 1084	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	82
PID 2672 wrote to memory of 1084	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	82
PID 2672 wrote to memory of 1084	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	82
PID 2672 wrote to memory of 928	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	83
PID 2672 wrote to memory of 928	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	83
PID 2672 wrote to memory of 928	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	83
PID 2672 wrote to memory of 2504	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	84
PID 2672 wrote to memory of 2504	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	84
PID 2672 wrote to memory of 2504	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	84
PID 2672 wrote to memory of 2176	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	85
PID 2672 wrote to memory of 2176	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	85
PID 2672 wrote to memory of 2176	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	85
PID 2672 wrote to memory of 1776	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	86
PID 2672 wrote to memory of 1776	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	86
PID 2672 wrote to memory of 1776	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	86
PID 2672 wrote to memory of 2836	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	87
PID 2672 wrote to memory of 2836	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	87
PID 2672 wrote to memory of 2836	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	87
PID 2672 wrote to memory of 284	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	88
PID 2672 wrote to memory of 284	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	88
PID 2672 wrote to memory of 284	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	88
PID 2672 wrote to memory of 2296	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	90
PID 2672 wrote to memory of 2296	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	90
PID 2672 wrote to memory of 2296	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	90
PID 2672 wrote to memory of 2140	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	91
PID 2672 wrote to memory of 2140	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	91
PID 2672 wrote to memory of 2140	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	91
PID 2672 wrote to memory of 1376	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	92
PID 2672 wrote to memory of 1376	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	92
PID 2672 wrote to memory of 1376	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	92
PID 2672 wrote to memory of 1364	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	93
PID 2672 wrote to memory of 1364	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	93
PID 2672 wrote to memory of 1364	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	93
PID 2672 wrote to memory of 2820	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	97
PID 2672 wrote to memory of 2820	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	97
PID 2672 wrote to memory of 2820	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	97
PID 2820 wrote to memory of 2532	2820	csrss.exe	110
PID 2820 wrote to memory of 2532	2820	csrss.exe	110
PID 2820 wrote to memory of 2532	2820	csrss.exe	110
PID 2820 wrote to memory of 2304	2820	csrss.exe	111
PID 2820 wrote to memory of 2304	2820	csrss.exe	111
PID 2820 wrote to memory of 2304	2820	csrss.exe	111
PID 2532 wrote to memory of 2728	2532	WScript.exe	112
PID 2532 wrote to memory of 2728	2532	WScript.exe	112
PID 2532 wrote to memory of 2728	2532	WScript.exe	112
PID 2728 wrote to memory of 2476	2728	csrss.exe	113
PID 2728 wrote to memory of 2476	2728	csrss.exe	113
PID 2728 wrote to memory of 2476	2728	csrss.exe	113
PID 2728 wrote to memory of 876	2728	csrss.exe	114

System policy modification 1 TTPs 21 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
"C:\Users\Admin\AppData\Local\Temp\d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellNew\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1364
- C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
  "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2820
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a3821d0-722a-47d3-973d-231730b7d884.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
      "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2728
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c6bf6ce-88a7-4246-bbc9-83b915f7bcbc.vbs"
        5⤵
        
        PID:2476
      - C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d37966b6-ee1a-4e57-98c9-93aa08ad7c43.vbs"
        7⤵
        
        PID:1696
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad8efd94-b572-4b96-b81a-838c1b211d2b.vbs"
        9⤵
        
        PID:2984
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a250a59-be1c-4422-a1dd-eba95bd30e86.vbs"
        11⤵
        
        PID:2236
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5450a8d-8aa3-4867-9057-a92455098eb6.vbs"
        13⤵
        
        PID:2844
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        14⤵
        
        PID:2968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\856aaf69-de33-4009-985c-5b5d33a18823.vbs"
        15⤵
        
        PID:1748
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        16⤵
        
        PID:2280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f54b900a-13cf-48eb-a55c-e86f8002bf2d.vbs"
        17⤵
        
        PID:316
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        18⤵
        
        PID:2408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\408c409a-9001-45f9-8ffb-7082269debe7.vbs"
        19⤵
        
        PID:1036
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        20⤵
        
        PID:1728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0c91154-be66-4cf6-b7fd-1453ad7897e5.vbs"
        21⤵
        
        PID:1580
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c12dc917-7d65-4b9c-84c7-e15a9b666609.vbs"
        21⤵
        
        PID:2848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60a9f8bc-9575-45d7-991e-f7a2b62d8d59.vbs"
        19⤵
        
        PID:1760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f2a4b60-d1d4-450a-8839-8fd0f1cc052e.vbs"
        17⤵
        
        PID:1204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae6c90ce-6a84-43cd-b025-003efa349cf3.vbs"
        15⤵
        
        PID:2476
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c2d73137-4df6-47df-82d7-e499c56eb717.vbs"
        13⤵
        
        PID:2656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ece0df0f-f1fa-4157-bea3-7c1aa31b603d.vbs"
        11⤵
        
        PID:1112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11a5c5a9-176b-4b13-b091-9e55bdfc1808.vbs"
        9⤵
        
        PID:2144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1684a2da-205e-45b6-be3b-b2c2c5598928.vbs"
        7⤵
        
        PID:2148
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d9d217e-4cfc-4263-9bbf-387bf0f4c0b3.vbs"
        5⤵
        
        PID:876
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\625210ca-834e-4170-bb10-008ea608bd42.vbs"
    3⤵
    PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\sppsvc.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\de-DE\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Windows\de-DE\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellNew\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\ShellNew\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellNew\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

services.exe

Path C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe
Size 1.9MB
SHA256 48b3972a45a0639c786bf0c62cf4a4ed0e1e22edd4bf69d09fc52bc142ffda63
MD5 01147f12aeacdb54ec1e8932443c24df
SHA1 70ba5ac3a6e51e228e4324b96c106cd18c2bc19b
SHA512 e9c875a30a96d0134fea7b1010a60f7ecca1e10a8a644cf10795b79e5ef8eab79ce15b810a80916a98b95cc9a362a81b5be8ad96ca032144264d7901109ba1b5
SSDEEP 24576:0z4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:0OMX0/08SVYTcxMXPxthD
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiPrvSE.exe

Path C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe
Size 1.9MB
SHA256 915a0ab9d24f16a769fe13797f84b094f926603d1ba9c518ce6a1fa26eef00a6
MD5 170559a1f10c26abf3f869f0e80d09b7
SHA1 7d4c11ec7cd9f16f6a9a46debddb04a215f9e4cc
SHA512 64eaee6bda8e828b23baf360a56a62146a4ef82c9e85e16eafaefa9efdf80d2e70b14b75680f02e001a7480a5e5d0b6af3a2171dc40e3943110e63196138edec
SSDEEP 24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSPPSVC.exe

Path C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe
Size 1.9MB
SHA256 03941491cc2c5792613a7f24c964338b9b8392c64694cb8ba7d0ca046b1d184f
MD5 f1f9692870a480628d8d0afc4aecf3a5
SHA1 64610a0bb2fac16de83d7a93a2a2782a28bdc981
SHA512 96a770caf7271109d0d8393115affe6479c8af8ba824fcfb9125f8ab2035fa2cabea18569aecfc218ede51e644e65ee64aedb4ed72744df5bccbc084803c8cc8
SSDEEP 24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Program Files\Windows Defender\explorer.exe
Size 1.9MB
SHA256 7923f4b1be9b15d3508e780d3a39858b74e765106a547963e7c81fe65ccf317f
MD5 8bb41fcf668043938200867029d716d0
SHA1 ba1912e5dabac0e0c438e64fc89dd84687ea4995
SHA512 d777e1ebf9d92e926f2eec8783ade2d03df5081a2ed71eb492149947093daf1141a7ff95721f8bc42bcdea383bba58cf99a20a9d7046ba2cb2f9ac438f941336
SSDEEP 24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD
MD5 SHA1 SHA512 SSDEEP

Submit Download

1c6bf6ce-88a7-4246-bbc9-83b915f7bcbc.vbs

Path C:\Users\Admin\AppData\Local\Temp\1c6bf6ce-88a7-4246-bbc9-83b915f7bcbc.vbs
Size 748B
SHA256 15afcc80baa9e4a1a6b3182bf5d7de6ab32cc78faaded008612874d49a44fa59
MD5 0c97be95c54a872c28e32f6c57f5495d
SHA1 71a08c7cb7aeeb6ca79bea82e57eb5d94584096a
SHA512 4f544f3fc2255af51a06eaf66fe628d49adb0f8f4bf2795a557196879f06ea9a59b010f3b903305b15fefa177764cc0a99c943194fbf28520111eac1730d6353
MD5 SHA1 SHA512

Submit Download

408c409a-9001-45f9-8ffb-7082269debe7.vbs

Path C:\Users\Admin\AppData\Local\Temp\408c409a-9001-45f9-8ffb-7082269debe7.vbs
Size 748B
SHA256 cfe9fc21cf343cc149d09fdaf43bd9cf2c49bd83ce6abcfa425b0381354c1c76
MD5 cb86e3193d24d9e87c982c1c34d30f28
SHA1 61aa85b732b5fb1ddaa7cbef196f3d91e60f1daf
SHA512 640cb0272ec570a0a0d90854f606dbbff50fd146ad99dec1fcdf298eba006c8d54716b349f29065a07972e1e9a507089bad989b716a395cdda3aac3f2424bdb2
MD5 SHA1 SHA512

Submit Download

4a250a59-be1c-4422-a1dd-eba95bd30e86.vbs

Path C:\Users\Admin\AppData\Local\Temp\4a250a59-be1c-4422-a1dd-eba95bd30e86.vbs
Size 747B
SHA256 40e2c2146ecf1c8cddca65716c148bfe97ac15bc3c1594b68f5b190047d03c3c
MD5 1377c3d4687a829a5bed3adb9bb349e0
SHA1 5e92dd080d065133355bae8d34ca19b032b3d2de
SHA512 a0eceb24d51feecc43b5796878590ad054a0939248471bcfbdbdc5d4fb4b93ba871202830d34abdc5f9f9bc02d24d9826c226edc7aa66f8bdd0d278f44b778f6
MD5 SHA1 SHA512

Submit Download

625210ca-834e-4170-bb10-008ea608bd42.vbs

Path C:\Users\Admin\AppData\Local\Temp\625210ca-834e-4170-bb10-008ea608bd42.vbs
Size 524B
SHA256 2ee5bc90faa5c656b970bf5781f0556865790699695b069d477c3f8edf5dadff
MD5 50762cf74ef86d930e2f2e288b0bf63d
SHA1 fb520e196c37b90c01fa9038ddeff20645ee3f95
SHA512 3226f6e04bd8c4173cf766f260c6d0f898e29955b3760b759110ca668d987f66acdf845ac068ba2e26402f3df93ccc9ec74dc9a72952eb2b15ac776c6ade2452
MD5 SHA1 SHA512

Submit Download

856aaf69-de33-4009-985c-5b5d33a18823.vbs

Path C:\Users\Admin\AppData\Local\Temp\856aaf69-de33-4009-985c-5b5d33a18823.vbs
Size 748B
SHA256 4b3962ac6398d068542c69902b8913791e251a9436d26a79534b2fec8e8beb61
MD5 f766ab739721b7d1b6ff002981d04265
SHA1 b2e2245d082ec9d5fb0113ef24e802c5edc65fa0
SHA512 4aeed50fcd17334bc7260c962793a80833aaa978df6bc8991982184109026ccb1457200539ad7bba2d414f5ba78082739c6338efdd23d1c7b0ec5257e5cd9eb8
MD5 SHA1 SHA512

Submit Download

8a3821d0-722a-47d3-973d-231730b7d884.vbs

Path C:\Users\Admin\AppData\Local\Temp\8a3821d0-722a-47d3-973d-231730b7d884.vbs
Size 748B
SHA256 fe21a3dea427e6e7c91c47066a6917a52b9604108ddc1b3941e2cc2023e51acd
MD5 6ed7399a3e3482ab606f89715b599837
SHA1 65662dfd3a7d424a7c021f5989cfd5d783456f11
SHA512 8dd45cf59da814e35e43536dac2e96225f01da092f2c65ec6345e7a2f097b1f08dca5a6d8f5f272236893c16e8336c6dfb316901f983f9eafb4320efc9d9757c
MD5 SHA1 SHA512

Submit Download

ad8efd94-b572-4b96-b81a-838c1b211d2b.vbs

Path C:\Users\Admin\AppData\Local\Temp\ad8efd94-b572-4b96-b81a-838c1b211d2b.vbs
Size 748B
SHA256 75c6f2ad13605544a4087a8ed262dbd80ef2833dc0164fbedb307ac001fa61aa
MD5 2fbef830a8c109b1a50bfe30c4be9f2d
SHA1 ec742bbb34df2bcf89ca9f4ea913b0600e9e6b4f
SHA512 8db216f76a27282a1149d55b7f34894f0e387757ea1b75b0a5a701a5db05a4cef8422ffcdf5cd56c42135f67b703d601ce53774c7a63823d7926afe505ee56cc
MD5 SHA1 SHA512

Submit Download

b5450a8d-8aa3-4867-9057-a92455098eb6.vbs

Path C:\Users\Admin\AppData\Local\Temp\b5450a8d-8aa3-4867-9057-a92455098eb6.vbs
Size 748B
SHA256 321b7f89bc0909472b081c23c2bc477fb07a31a8f657894c570b3cb0cc830f23
MD5 2bc369fa50518ba741f27f24df93b68b
SHA1 983cbc2a0fc9b5b5cf2ca3045228db1d03f91165
SHA512 d9a9aaec00f76e60ae340673fa77950b974e43a80015909eb472c03b4dd5dd13dc24b442ea643e3f64df635d4e29076349740dc9068d06cd8ff9a39fa85fcaaa
MD5 SHA1 SHA512

Submit Download

c0c91154-be66-4cf6-b7fd-1453ad7897e5.vbs

Path C:\Users\Admin\AppData\Local\Temp\c0c91154-be66-4cf6-b7fd-1453ad7897e5.vbs
Size 748B
SHA256 17836828f4052370831057462e24c06e1f3dc6c92d6078d5c7cfc601e105237d
MD5 cd94ea895f9d5d5dba428a9aa9e4506e
SHA1 c4754a36a10bb8931598c958c03cfbb509ee41c9
SHA512 20cfaa4166d3307bb0062137ebfa8dc296a471f6937e1094495ec754be666d8ec31f884b13022e504c05fc9bb89bd219ddcd9816cc4be70487ba1ea66059fe81
MD5 SHA1 SHA512

Submit Download

d37966b6-ee1a-4e57-98c9-93aa08ad7c43.vbs

Path C:\Users\Admin\AppData\Local\Temp\d37966b6-ee1a-4e57-98c9-93aa08ad7c43.vbs
Size 747B
SHA256 bd51da912ab86232338da2db820e6291fb1f70c6d8dc92196d553ffb57b530b5
MD5 6b144057302c9d1ce980caadcba46269
SHA1 f212bb46d22626ac14e8de3a49339b5dc6cdebf2
SHA512 6fdc2b33c8f8757ea97db07fca82108a25dd03aace52e8686fffd4a89f197e6f67b87d018d256ca8aa752c47f4d005aefb865b73d7dfd4ecdd2403fb50244d37
MD5 SHA1 SHA512

Submit Download

f54b900a-13cf-48eb-a55c-e86f8002bf2d.vbs

Path C:\Users\Admin\AppData\Local\Temp\f54b900a-13cf-48eb-a55c-e86f8002bf2d.vbs
Size 748B
SHA256 1e51b686f9ee4400350a8623819dfd32d33506e7bcb3113cfa0bf31bfde3cb92
MD5 7675e43d7c7a65af974c9f56d2a6e712
SHA1 0c86d470b03a50ced2183a32ffa3f3d988f9b5e2
SHA512 27f6226be83a9bd6441a0daffd81b27641a89d7b0bc77fd2eaf8844b7f336188e1b1a538eff8ba5a8deee21b85cd95e4b833db6def9dc84f0601db1fa3e21ac9
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 7dd24a294880ffa9ec30d463c1cb697ce0db6cf5237fa057d61bce4c6eadadd7
MD5 553ec65e639b5adff16f2be669be9762
SHA1 df0872b66080c4905a76849b237c2cf8c66d0170
SHA512 6d0906ebbad1b4764a4afde1dbb3c15b20dc07d547f02c8c51b327e0bbf1e489bf98f5b485a999a6c5e495334b2fa083a3e125249cb86ca4d82e9a238e8152c0
SSDEEP 96:cRb6Cx3M8XnqvsqvJCwol2Rb6Cx3M8XnqvsEHyqvJCwor3qyypQHQhU2U7BmXlUl:kn37Uolan37AHnor3qJhhU2U7BmKP
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Users\Default\smss.exe
Size 1.9MB
SHA256 d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea
MD5 371ac901265784870ebce3b2f6d4c663
SHA1 624369382a311fd84568a61b309f8414b8ca7c07
SHA512 28a83331b901295d597616364a429020e7879aaa1abb5c690e98bd96f385a8ed5dbe27435c94d525a678c4cc4e3c6228f00fa5356828ec53b540ac67def51d27
SSDEEP 24576:Uz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:UOMX0/08SVYTcxMXPxthD
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Windows\ShellNew\winlogon.exe
Size 1.9MB
SHA256 ec4032b0a2dff94083852dca51cbb791300739ef1d3eb031f637c74976a809b8
MD5 377469559703ab81ea6dba9638365bf3
SHA1 507499409aaa030a39846fdfa3ac581b215ee3b0
SHA512 8975dfb72fd9ca8ba07ccb361b9e13bc8d9dbb50a33ebcbb875328f65eed0cc6f6c160932d2dc42c8fef59fc97dc78bd75cb3aa8ffdfadb0f1624dceb5060417
SSDEEP 24576:Uz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:UOMX0/08SVYTcxMXPxthD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/912-344-0x00000000011E0000-0x00000000013CA000-memory.dmp

Download

memory/912-345-0x00000000005E0000-0x0000000000636000-memory.dmp

Download

memory/2280-404-0x00000000003E0000-0x00000000005CA000-memory.dmp

Download

memory/2280-405-0x0000000000710000-0x0000000000766000-memory.dmp

Download

memory/2408-417-0x00000000010C0000-0x00000000012AA000-memory.dmp

Download

memory/2604-379-0x0000000000390000-0x000000000057A000-memory.dmp

Download

memory/2672-17-0x00000000023E0000-0x00000000023EC000-memory.dmp

Download

memory/2672-15-0x00000000023C0000-0x00000000023CE000-memory.dmp

Download

memory/2672-231-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Download

memory/2672-239-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Download

memory/2672-1-0x0000000000890000-0x0000000000A7A000-memory.dmp

Download

memory/2672-218-0x000007FEF6113000-0x000007FEF6114000-memory.dmp

Download

memory/2672-2-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Download

memory/2672-3-0x0000000000870000-0x000000000088C000-memory.dmp

Download

memory/2672-8-0x0000000002160000-0x00000000021B6000-memory.dmp

Download

memory/2672-13-0x0000000002380000-0x000000000238C000-memory.dmp

Download

memory/2672-6-0x0000000002130000-0x0000000002146000-memory.dmp

Download

memory/2672-7-0x0000000002150000-0x000000000215A000-memory.dmp

Download

memory/2672-16-0x00000000023D0000-0x00000000023D8000-memory.dmp

Download

memory/2672-0-0x000007FEF6113000-0x000007FEF6114000-memory.dmp

Download

memory/2672-18-0x000000001A8D0000-0x000000001A8DC000-memory.dmp

Download

memory/2672-14-0x00000000023B0000-0x00000000023BA000-memory.dmp

Download

memory/2672-9-0x00000000021B0000-0x00000000021BC000-memory.dmp

Download

memory/2672-12-0x0000000002250000-0x0000000002262000-memory.dmp

Download

memory/2672-10-0x00000000021C0000-0x00000000021C8000-memory.dmp

Download

memory/2672-4-0x0000000000450000-0x0000000000458000-memory.dmp

Download

memory/2672-5-0x0000000002120000-0x0000000002130000-memory.dmp

Download

memory/2728-332-0x0000000000330000-0x000000000051A000-memory.dmp

Download

memory/2760-255-0x000000001B640000-0x000000001B922000-memory.dmp

Download

memory/2760-256-0x0000000002A00000-0x0000000002A08000-memory.dmp

Download

memory/2820-238-0x0000000000830000-0x0000000000A1A000-memory.dmp

Download

memory/2820-262-0x00000000005D0000-0x0000000000626000-memory.dmp

Download

memory/2968-392-0x0000000000350000-0x0000000000362000-memory.dmp

Download

memory/2968-391-0x0000000000360000-0x000000000054A000-memory.dmp

Download