e9e6a5e4d64f01b158801bbaead6aedfeeb8cd754e734d1471f591ca3e2c08f8

Analysis

max time kernel
77s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Size

1.9MB
MD5

371ac901265784870ebce3b2f6d4c663
SHA1

624369382a311fd84568a61b309f8414b8ca7c07
SHA256

d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea
SHA512

28a83331b901295d597616364a429020e7879aaa1abb5c690e98bd96f385a8ed5dbe27435c94d525a678c4cc4e3c6228f00fa5356828ec53b540ac67def51d27
SSDEEP

24576:Uz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:UOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	3008	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	3008	schtasks.exe	30

UAC bypass 3 TTPs 21 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2296	powershell.exe
2140	powershell.exe
1376	powershell.exe
1856	powershell.exe
1356	powershell.exe
2176	powershell.exe
2504	powershell.exe
2612	powershell.exe
2760	powershell.exe
1084	powershell.exe
928	powershell.exe
2836	powershell.exe
1364	powershell.exe
1968	powershell.exe
1776	powershell.exe
284	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe

Executes dropped EXE 6 IoCs

pid	Process
2820	csrss.exe
2728	csrss.exe
912	csrss.exe
2768	csrss.exe
808	csrss.exe
2604	csrss.exe

Checks whether UAC is enabled 1 TTPs 14 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\24dbde2999530e	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files\Google\Chrome\sppsvc.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\24dbde2999530e	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\RCXCE60.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\RCXBCE1.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\RCXC0EC.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Google\Chrome\sppsvc.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\RCXC2F1.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\6203df4a6bafc7	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\1610b97d3ab4a7	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Windows Defender\RCXB666.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Google\Chrome\RCXB8D9.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\RCXC0EB.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Windows Defender\explorer.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files\Windows Defender\7a0fd90576e088	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files\Google\Chrome\0a1fd5f707cd16	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\886983d96e3d3e	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\RCXBCE2.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Windows Defender\RCXB6D4.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files\Google\Chrome\RCXB8D8.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\RCXCDF2.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Program Files\Windows Defender\explorer.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\RCXC2F0.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\RCXC4F5.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\RCXC563.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ShellNew\RCXD558.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Windows\ShellNew\winlogon.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Windows\de-DE\42af1c969fbb7b	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Windows\ShellNew\cc11b995f2a76d	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Windows\de-DE\RCXC9E8.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Windows\de-DE\audiodg.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Windows\de-DE\audiodg.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File created	C:\Windows\ShellNew\winlogon.exe	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Windows\de-DE\RCXC9E9.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
File opened for modification	C:\Windows\ShellNew\RCXD4EA.tmp	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2348	schtasks.exe
2756	schtasks.exe
2004	schtasks.exe
2084	schtasks.exe
1868	schtasks.exe
2984	schtasks.exe
2952	schtasks.exe
592	schtasks.exe
2844	schtasks.exe
2872	schtasks.exe
2940	schtasks.exe
2792	schtasks.exe
1564	schtasks.exe
1712	schtasks.exe
2128	schtasks.exe
980	schtasks.exe
2624	schtasks.exe
2476	schtasks.exe
1924	schtasks.exe
2812	schtasks.exe
2608	schtasks.exe
944	schtasks.exe
900	schtasks.exe
2948	schtasks.exe
316	schtasks.exe
2076	schtasks.exe
1832	schtasks.exe
1652	schtasks.exe
2820	schtasks.exe
2204	schtasks.exe
3044	schtasks.exe
2184	schtasks.exe
2968	schtasks.exe
2468	schtasks.exe
1676	schtasks.exe
692	schtasks.exe
2308	schtasks.exe
2432	schtasks.exe
2052	schtasks.exe
2828	schtasks.exe
2148	schtasks.exe
2720	schtasks.exe
2956	schtasks.exe
1632	schtasks.exe
2588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
2760	powershell.exe
284	powershell.exe
1376	powershell.exe
1084	powershell.exe
2504	powershell.exe
2836	powershell.exe
2612	powershell.exe
1968	powershell.exe
1856	powershell.exe
2140	powershell.exe
1776	powershell.exe
2296	powershell.exe
1356	powershell.exe
1364	powershell.exe
2176	powershell.exe
928	powershell.exe
2820	csrss.exe
2728	csrss.exe
912	csrss.exe
2768	csrss.exe
808	csrss.exe
2604	csrss.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Token: SeDebugPrivilege	2820	csrss.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	284	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	2728	csrss.exe
Token: SeDebugPrivilege	912	csrss.exe
Token: SeDebugPrivilege	2768	csrss.exe
Token: SeDebugPrivilege	808	csrss.exe
Token: SeDebugPrivilege	2604	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1856	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	77
PID 2672 wrote to memory of 1856	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	77
PID 2672 wrote to memory of 1856	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	77
PID 2672 wrote to memory of 1968	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	78
PID 2672 wrote to memory of 1968	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	78
PID 2672 wrote to memory of 1968	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	78
PID 2672 wrote to memory of 2612	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	79
PID 2672 wrote to memory of 2612	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	79
PID 2672 wrote to memory of 2612	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	79
PID 2672 wrote to memory of 2760	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	80
PID 2672 wrote to memory of 2760	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	80
PID 2672 wrote to memory of 2760	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	80
PID 2672 wrote to memory of 1356	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	81
PID 2672 wrote to memory of 1356	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	81
PID 2672 wrote to memory of 1356	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	81
PID 2672 wrote to memory of 1084	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	82
PID 2672 wrote to memory of 1084	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	82
PID 2672 wrote to memory of 1084	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	82
PID 2672 wrote to memory of 928	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	83
PID 2672 wrote to memory of 928	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	83
PID 2672 wrote to memory of 928	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	83
PID 2672 wrote to memory of 2504	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	84
PID 2672 wrote to memory of 2504	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	84
PID 2672 wrote to memory of 2504	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	84
PID 2672 wrote to memory of 2176	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	85
PID 2672 wrote to memory of 2176	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	85
PID 2672 wrote to memory of 2176	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	85
PID 2672 wrote to memory of 1776	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	86
PID 2672 wrote to memory of 1776	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	86
PID 2672 wrote to memory of 1776	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	86
PID 2672 wrote to memory of 2836	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	87
PID 2672 wrote to memory of 2836	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	87
PID 2672 wrote to memory of 2836	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	87
PID 2672 wrote to memory of 284	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	88
PID 2672 wrote to memory of 284	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	88
PID 2672 wrote to memory of 284	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	88
PID 2672 wrote to memory of 2296	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	90
PID 2672 wrote to memory of 2296	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	90
PID 2672 wrote to memory of 2296	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	90
PID 2672 wrote to memory of 2140	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	91
PID 2672 wrote to memory of 2140	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	91
PID 2672 wrote to memory of 2140	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	91
PID 2672 wrote to memory of 1376	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	92
PID 2672 wrote to memory of 1376	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	92
PID 2672 wrote to memory of 1376	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	92
PID 2672 wrote to memory of 1364	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	93
PID 2672 wrote to memory of 1364	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	93
PID 2672 wrote to memory of 1364	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	93
PID 2672 wrote to memory of 2820	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	97
PID 2672 wrote to memory of 2820	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	97
PID 2672 wrote to memory of 2820	2672	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe	97
PID 2820 wrote to memory of 2532	2820	csrss.exe	110
PID 2820 wrote to memory of 2532	2820	csrss.exe	110
PID 2820 wrote to memory of 2532	2820	csrss.exe	110
PID 2820 wrote to memory of 2304	2820	csrss.exe	111
PID 2820 wrote to memory of 2304	2820	csrss.exe	111
PID 2820 wrote to memory of 2304	2820	csrss.exe	111
PID 2532 wrote to memory of 2728	2532	WScript.exe	112
PID 2532 wrote to memory of 2728	2532	WScript.exe	112
PID 2532 wrote to memory of 2728	2532	WScript.exe	112
PID 2728 wrote to memory of 2476	2728	csrss.exe	113
PID 2728 wrote to memory of 2476	2728	csrss.exe	113
PID 2728 wrote to memory of 2476	2728	csrss.exe	113
PID 2728 wrote to memory of 876	2728	csrss.exe	114

System policy modification 1 TTPs 21 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
"C:\Users\Admin\AppData\Local\Temp\d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellNew\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1364
- C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
  "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2820
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a3821d0-722a-47d3-973d-231730b7d884.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
      "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2728
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c6bf6ce-88a7-4246-bbc9-83b915f7bcbc.vbs"
        5⤵
        
        PID:2476
      - C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d37966b6-ee1a-4e57-98c9-93aa08ad7c43.vbs"
        7⤵
        
        PID:1696
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad8efd94-b572-4b96-b81a-838c1b211d2b.vbs"
        9⤵
        
        PID:2984
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a250a59-be1c-4422-a1dd-eba95bd30e86.vbs"
        11⤵
        
        PID:2236
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5450a8d-8aa3-4867-9057-a92455098eb6.vbs"
        13⤵
        
        PID:2844
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        14⤵
        
        PID:2968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\856aaf69-de33-4009-985c-5b5d33a18823.vbs"
        15⤵
        
        PID:1748
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        16⤵
        
        PID:2280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f54b900a-13cf-48eb-a55c-e86f8002bf2d.vbs"
        17⤵
        
        PID:316
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        18⤵
        
        PID:2408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\408c409a-9001-45f9-8ffb-7082269debe7.vbs"
        19⤵
        
        PID:1036
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe"
        20⤵
        
        PID:1728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0c91154-be66-4cf6-b7fd-1453ad7897e5.vbs"
        21⤵
        
        PID:1580
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c12dc917-7d65-4b9c-84c7-e15a9b666609.vbs"
        21⤵
        
        PID:2848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60a9f8bc-9575-45d7-991e-f7a2b62d8d59.vbs"
        19⤵
        
        PID:1760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f2a4b60-d1d4-450a-8839-8fd0f1cc052e.vbs"
        17⤵
        
        PID:1204
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae6c90ce-6a84-43cd-b025-003efa349cf3.vbs"
        15⤵
        
        PID:2476
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c2d73137-4df6-47df-82d7-e499c56eb717.vbs"
        13⤵
        
        PID:2656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ece0df0f-f1fa-4157-bea3-7c1aa31b603d.vbs"
        11⤵
        
        PID:1112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11a5c5a9-176b-4b13-b091-9e55bdfc1808.vbs"
        9⤵
        
        PID:2144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1684a2da-205e-45b6-be3b-b2c2c5598928.vbs"
        7⤵
        
        PID:2148
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d9d217e-4cfc-4263-9bbf-387bf0f4c0b3.vbs"
        5⤵
        
        PID:876
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\625210ca-834e-4170-bb10-008ea608bd42.vbs"
    3⤵
    PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\sppsvc.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Adobe\Acrobat\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\de-DE\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Windows\de-DE\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellNew\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\ShellNew\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellNew\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe

Filesize
1.9MB

MD5
01147f12aeacdb54ec1e8932443c24df

SHA1
70ba5ac3a6e51e228e4324b96c106cd18c2bc19b

SHA256
48b3972a45a0639c786bf0c62cf4a4ed0e1e22edd4bf69d09fc52bc142ffda63

SHA512
e9c875a30a96d0134fea7b1010a60f7ecca1e10a8a644cf10795b79e5ef8eab79ce15b810a80916a98b95cc9a362a81b5be8ad96ca032144264d7901109ba1b5

Download Submit
C:\Program Files (x86)\Internet Explorer\ja-JP\WmiPrvSE.exe

Filesize
1.9MB

MD5
170559a1f10c26abf3f869f0e80d09b7

SHA1
7d4c11ec7cd9f16f6a9a46debddb04a215f9e4cc

SHA256
915a0ab9d24f16a769fe13797f84b094f926603d1ba9c518ce6a1fa26eef00a6

SHA512
64eaee6bda8e828b23baf360a56a62146a4ef82c9e85e16eafaefa9efdf80d2e70b14b75680f02e001a7480a5e5d0b6af3a2171dc40e3943110e63196138edec

Download Submit
C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\OSPPSVC.exe

Filesize
1.9MB

MD5
f1f9692870a480628d8d0afc4aecf3a5

SHA1
64610a0bb2fac16de83d7a93a2a2782a28bdc981

SHA256
03941491cc2c5792613a7f24c964338b9b8392c64694cb8ba7d0ca046b1d184f

SHA512
96a770caf7271109d0d8393115affe6479c8af8ba824fcfb9125f8ab2035fa2cabea18569aecfc218ede51e644e65ee64aedb4ed72744df5bccbc084803c8cc8

Download Submit
C:\Program Files\Windows Defender\explorer.exe

Filesize
1.9MB

MD5
8bb41fcf668043938200867029d716d0

SHA1
ba1912e5dabac0e0c438e64fc89dd84687ea4995

SHA256
7923f4b1be9b15d3508e780d3a39858b74e765106a547963e7c81fe65ccf317f

SHA512
d777e1ebf9d92e926f2eec8783ade2d03df5081a2ed71eb492149947093daf1141a7ff95721f8bc42bcdea383bba58cf99a20a9d7046ba2cb2f9ac438f941336

Download Submit
C:\Users\Admin\AppData\Local\Temp\1c6bf6ce-88a7-4246-bbc9-83b915f7bcbc.vbs

Filesize
748B

MD5
0c97be95c54a872c28e32f6c57f5495d

SHA1
71a08c7cb7aeeb6ca79bea82e57eb5d94584096a

SHA256
15afcc80baa9e4a1a6b3182bf5d7de6ab32cc78faaded008612874d49a44fa59

SHA512
4f544f3fc2255af51a06eaf66fe628d49adb0f8f4bf2795a557196879f06ea9a59b010f3b903305b15fefa177764cc0a99c943194fbf28520111eac1730d6353

Download Submit
C:\Users\Admin\AppData\Local\Temp\408c409a-9001-45f9-8ffb-7082269debe7.vbs

Filesize
748B

MD5
cb86e3193d24d9e87c982c1c34d30f28

SHA1
61aa85b732b5fb1ddaa7cbef196f3d91e60f1daf

SHA256
cfe9fc21cf343cc149d09fdaf43bd9cf2c49bd83ce6abcfa425b0381354c1c76

SHA512
640cb0272ec570a0a0d90854f606dbbff50fd146ad99dec1fcdf298eba006c8d54716b349f29065a07972e1e9a507089bad989b716a395cdda3aac3f2424bdb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\4a250a59-be1c-4422-a1dd-eba95bd30e86.vbs

Filesize
747B

MD5
1377c3d4687a829a5bed3adb9bb349e0

SHA1
5e92dd080d065133355bae8d34ca19b032b3d2de

SHA256
40e2c2146ecf1c8cddca65716c148bfe97ac15bc3c1594b68f5b190047d03c3c

SHA512
a0eceb24d51feecc43b5796878590ad054a0939248471bcfbdbdc5d4fb4b93ba871202830d34abdc5f9f9bc02d24d9826c226edc7aa66f8bdd0d278f44b778f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\625210ca-834e-4170-bb10-008ea608bd42.vbs

Filesize
524B

MD5
50762cf74ef86d930e2f2e288b0bf63d

SHA1
fb520e196c37b90c01fa9038ddeff20645ee3f95

SHA256
2ee5bc90faa5c656b970bf5781f0556865790699695b069d477c3f8edf5dadff

SHA512
3226f6e04bd8c4173cf766f260c6d0f898e29955b3760b759110ca668d987f66acdf845ac068ba2e26402f3df93ccc9ec74dc9a72952eb2b15ac776c6ade2452

Download Submit
C:\Users\Admin\AppData\Local\Temp\856aaf69-de33-4009-985c-5b5d33a18823.vbs

Filesize
748B

MD5
f766ab739721b7d1b6ff002981d04265

SHA1
b2e2245d082ec9d5fb0113ef24e802c5edc65fa0

SHA256
4b3962ac6398d068542c69902b8913791e251a9436d26a79534b2fec8e8beb61

SHA512
4aeed50fcd17334bc7260c962793a80833aaa978df6bc8991982184109026ccb1457200539ad7bba2d414f5ba78082739c6338efdd23d1c7b0ec5257e5cd9eb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\8a3821d0-722a-47d3-973d-231730b7d884.vbs

Filesize
748B

MD5
6ed7399a3e3482ab606f89715b599837

SHA1
65662dfd3a7d424a7c021f5989cfd5d783456f11

SHA256
fe21a3dea427e6e7c91c47066a6917a52b9604108ddc1b3941e2cc2023e51acd

SHA512
8dd45cf59da814e35e43536dac2e96225f01da092f2c65ec6345e7a2f097b1f08dca5a6d8f5f272236893c16e8336c6dfb316901f983f9eafb4320efc9d9757c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ad8efd94-b572-4b96-b81a-838c1b211d2b.vbs

Filesize
748B

MD5
2fbef830a8c109b1a50bfe30c4be9f2d

SHA1
ec742bbb34df2bcf89ca9f4ea913b0600e9e6b4f

SHA256
75c6f2ad13605544a4087a8ed262dbd80ef2833dc0164fbedb307ac001fa61aa

SHA512
8db216f76a27282a1149d55b7f34894f0e387757ea1b75b0a5a701a5db05a4cef8422ffcdf5cd56c42135f67b703d601ce53774c7a63823d7926afe505ee56cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5450a8d-8aa3-4867-9057-a92455098eb6.vbs

Filesize
748B

MD5
2bc369fa50518ba741f27f24df93b68b

SHA1
983cbc2a0fc9b5b5cf2ca3045228db1d03f91165

SHA256
321b7f89bc0909472b081c23c2bc477fb07a31a8f657894c570b3cb0cc830f23

SHA512
d9a9aaec00f76e60ae340673fa77950b974e43a80015909eb472c03b4dd5dd13dc24b442ea643e3f64df635d4e29076349740dc9068d06cd8ff9a39fa85fcaaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0c91154-be66-4cf6-b7fd-1453ad7897e5.vbs

Filesize
748B

MD5
cd94ea895f9d5d5dba428a9aa9e4506e

SHA1
c4754a36a10bb8931598c958c03cfbb509ee41c9

SHA256
17836828f4052370831057462e24c06e1f3dc6c92d6078d5c7cfc601e105237d

SHA512
20cfaa4166d3307bb0062137ebfa8dc296a471f6937e1094495ec754be666d8ec31f884b13022e504c05fc9bb89bd219ddcd9816cc4be70487ba1ea66059fe81

Download Submit
C:\Users\Admin\AppData\Local\Temp\d37966b6-ee1a-4e57-98c9-93aa08ad7c43.vbs

Filesize
747B

MD5
6b144057302c9d1ce980caadcba46269

SHA1
f212bb46d22626ac14e8de3a49339b5dc6cdebf2

SHA256
bd51da912ab86232338da2db820e6291fb1f70c6d8dc92196d553ffb57b530b5

SHA512
6fdc2b33c8f8757ea97db07fca82108a25dd03aace52e8686fffd4a89f197e6f67b87d018d256ca8aa752c47f4d005aefb865b73d7dfd4ecdd2403fb50244d37

Download Submit
C:\Users\Admin\AppData\Local\Temp\f54b900a-13cf-48eb-a55c-e86f8002bf2d.vbs

Filesize
748B

MD5
7675e43d7c7a65af974c9f56d2a6e712

SHA1
0c86d470b03a50ced2183a32ffa3f3d988f9b5e2

SHA256
1e51b686f9ee4400350a8623819dfd32d33506e7bcb3113cfa0bf31bfde3cb92

SHA512
27f6226be83a9bd6441a0daffd81b27641a89d7b0bc77fd2eaf8844b7f336188e1b1a538eff8ba5a8deee21b85cd95e4b833db6def9dc84f0601db1fa3e21ac9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
553ec65e639b5adff16f2be669be9762

SHA1
df0872b66080c4905a76849b237c2cf8c66d0170

SHA256
7dd24a294880ffa9ec30d463c1cb697ce0db6cf5237fa057d61bce4c6eadadd7

SHA512
6d0906ebbad1b4764a4afde1dbb3c15b20dc07d547f02c8c51b327e0bbf1e489bf98f5b485a999a6c5e495334b2fa083a3e125249cb86ca4d82e9a238e8152c0

Download Submit
C:\Users\Default\smss.exe

Filesize
1.9MB

MD5
371ac901265784870ebce3b2f6d4c663

SHA1
624369382a311fd84568a61b309f8414b8ca7c07

SHA256
d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea

SHA512
28a83331b901295d597616364a429020e7879aaa1abb5c690e98bd96f385a8ed5dbe27435c94d525a678c4cc4e3c6228f00fa5356828ec53b540ac67def51d27

Download Submit
C:\Windows\ShellNew\winlogon.exe

Filesize
1.9MB

MD5
377469559703ab81ea6dba9638365bf3

SHA1
507499409aaa030a39846fdfa3ac581b215ee3b0

SHA256
ec4032b0a2dff94083852dca51cbb791300739ef1d3eb031f637c74976a809b8

SHA512
8975dfb72fd9ca8ba07ccb361b9e13bc8d9dbb50a33ebcbb875328f65eed0cc6f6c160932d2dc42c8fef59fc97dc78bd75cb3aa8ffdfadb0f1624dceb5060417

Download Submit
memory/912-344-0x00000000011E0000-0x00000000013CA000-memory.dmp

Filesize
1.9MB

Download
memory/912-345-0x00000000005E0000-0x0000000000636000-memory.dmp

Filesize
344KB

Download
memory/2280-404-0x00000000003E0000-0x00000000005CA000-memory.dmp

Filesize
1.9MB

Download
memory/2280-405-0x0000000000710000-0x0000000000766000-memory.dmp

Filesize
344KB

Download
memory/2408-417-0x00000000010C0000-0x00000000012AA000-memory.dmp

Filesize
1.9MB

Download
memory/2604-379-0x0000000000390000-0x000000000057A000-memory.dmp

Filesize
1.9MB

Download
memory/2672-17-0x00000000023E0000-0x00000000023EC000-memory.dmp

Filesize
48KB

Download
memory/2672-15-0x00000000023C0000-0x00000000023CE000-memory.dmp

Filesize
56KB

Download
memory/2672-231-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-239-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-1-0x0000000000890000-0x0000000000A7A000-memory.dmp

Filesize
1.9MB

Download
memory/2672-218-0x000007FEF6113000-0x000007FEF6114000-memory.dmp

Filesize
4KB

Download
memory/2672-2-0x000007FEF6110000-0x000007FEF6AFC000-memory.dmp

Filesize
9.9MB

Download
memory/2672-3-0x0000000000870000-0x000000000088C000-memory.dmp

Filesize
112KB

Download
memory/2672-8-0x0000000002160000-0x00000000021B6000-memory.dmp

Filesize
344KB

Download
memory/2672-13-0x0000000002380000-0x000000000238C000-memory.dmp

Filesize
48KB

Download
memory/2672-6-0x0000000002130000-0x0000000002146000-memory.dmp

Filesize
88KB

Download
memory/2672-7-0x0000000002150000-0x000000000215A000-memory.dmp

Filesize
40KB

Download
memory/2672-16-0x00000000023D0000-0x00000000023D8000-memory.dmp

Filesize
32KB

Download
memory/2672-0-0x000007FEF6113000-0x000007FEF6114000-memory.dmp

Filesize
4KB

Download
memory/2672-18-0x000000001A8D0000-0x000000001A8DC000-memory.dmp

Filesize
48KB

Download
memory/2672-14-0x00000000023B0000-0x00000000023BA000-memory.dmp

Filesize
40KB

Download
memory/2672-9-0x00000000021B0000-0x00000000021BC000-memory.dmp

Filesize
48KB

Download
memory/2672-12-0x0000000002250000-0x0000000002262000-memory.dmp

Filesize
72KB

Download
memory/2672-10-0x00000000021C0000-0x00000000021C8000-memory.dmp

Filesize
32KB

Download
memory/2672-4-0x0000000000450000-0x0000000000458000-memory.dmp

Filesize
32KB

Download
memory/2672-5-0x0000000002120000-0x0000000002130000-memory.dmp

Filesize
64KB

Download
memory/2728-332-0x0000000000330000-0x000000000051A000-memory.dmp

Filesize
1.9MB

Download
memory/2760-255-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2760-256-0x0000000002A00000-0x0000000002A08000-memory.dmp

Filesize
32KB

Download
memory/2820-238-0x0000000000830000-0x0000000000A1A000-memory.dmp

Filesize
1.9MB

Download
memory/2820-262-0x00000000005D0000-0x0000000000626000-memory.dmp

Filesize
344KB

Download
memory/2968-392-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2968-391-0x0000000000360000-0x000000000054A000-memory.dmp

Filesize
1.9MB

Download