f08d555b265bc840ef4d7904f37de7886b276d3b2f85180bb63b0e29445e02b1

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:16 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Size

1.9MB
MD5

8e079931976b660c64ddb79468d6075b
SHA1

e728c1b735c98351be645a68934edad1f52e09b3
SHA256

c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428
SHA512

36e997cb6b10099db8271303d8b3f5fcb6166104720819afb2a257071e34dddb06d6f9178145680b4aa1712fa1e03d3ba9984cc900e6b42244bf2a3e3faa67e9
SSDEEP

24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6056	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5952	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5596	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6076	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5812	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5228	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5704	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5788	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5416	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	4968	schtasks.exe	89

UAC bypass 3 TTPs 30 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6028	powershell.exe
1520	powershell.exe
1160	powershell.exe
5044	powershell.exe
1500	powershell.exe
5228	powershell.exe
3068	powershell.exe
2536	powershell.exe
2632	powershell.exe
6056	powershell.exe
2896	powershell.exe
1368	powershell.exe
5320	powershell.exe
5236	powershell.exe
5084	powershell.exe
3000	powershell.exe
2572	powershell.exe
1384	powershell.exe
1200	powershell.exe
1220	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 9 IoCs

pid	Process
3460	RuntimeBroker.exe
5680	RuntimeBroker.exe
3832	RuntimeBroker.exe
3068	RuntimeBroker.exe
4332	RuntimeBroker.exe
2680	RuntimeBroker.exe
3612	RuntimeBroker.exe
5992	RuntimeBroker.exe
3552	RuntimeBroker.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files\edge_BITS_4764_811068770\csrss.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\StartMenuExperienceHost.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files (x86)\Windows NT\RCX6AD7.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files\edge_BITS_4800_1922016304\RCX7B40.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files (x86)\Windows Portable Devices\smss.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files\edge_BITS_4764_811068770\886983d96e3d3e	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files\edge_BITS_4764_811068770\RCX826A.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\RCX8BAA.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX67C6.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\smss.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files\edge_BITS_4800_1922016304\RCX7B3F.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files (x86)\Windows Portable Devices\69ddcba757bf72	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files (x86)\Windows NT\fontdrvhost.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files (x86)\Windows NT\5b884080fd4f94	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files\edge_BITS_4800_1922016304\69ddcba757bf72	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\55b276f4edf653	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files\edge_BITS_4800_1922016304\smss.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX67C7.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\RCX7DC3.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files\edge_BITS_4764_811068770\csrss.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files (x86)\Windows Media Player\Icons\sihost.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files (x86)\Windows NT\fontdrvhost.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\RCX7DC2.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files\edge_BITS_4764_811068770\RCX81EC.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\backgroundTaskHost.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\9e8d7a4ca61bd9	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\StartMenuExperienceHost.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files (x86)\Windows NT\RCX6A59.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\RCX8B2C.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Program Files\edge_BITS_4800_1922016304\smss.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\de-DE\OfficeClickToRun.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Windows\IdentityCRL\production\taskhostw.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Windows\IdentityCRL\production\ea9f0e6c9e2dcd	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Windows\CbsTemp\RuntimeBroker.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Windows\security\database\6cb0b6c459d5d3	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\CbsTemp\RCX7FD7.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\CbsTemp\RCX7FD8.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\CbsTemp\RuntimeBroker.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\de-DE\RCX6CDB.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\IdentityCRL\production\RCX7163.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\IdentityCRL\production\taskhostw.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\security\database\RCX8701.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\de-DE\OfficeClickToRun.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Windows\de-DE\e6c9b481da804f	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\System.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\de-DE\RCX6CDC.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Windows\CbsTemp\9e8d7a4ca61bd9	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File created	C:\Windows\security\database\dwm.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\IdentityCRL\production\RCX71D2.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\security\database\RCX8702.tmp	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
File opened for modification	C:\Windows\security\database\dwm.exe	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4184	schtasks.exe
5812	schtasks.exe
1220	schtasks.exe
3152	schtasks.exe
4568	schtasks.exe
4572	schtasks.exe
3688	schtasks.exe
4756	schtasks.exe
4512	schtasks.exe
2980	schtasks.exe
4464	schtasks.exe
4716	schtasks.exe
3004	schtasks.exe
6056	schtasks.exe
5228	schtasks.exe
3000	schtasks.exe
3944	schtasks.exe
4620	schtasks.exe
4932	schtasks.exe
552	schtasks.exe
5952	schtasks.exe
1992	schtasks.exe
696	schtasks.exe
4836	schtasks.exe
3640	schtasks.exe
5704	schtasks.exe
5788	schtasks.exe
4920	schtasks.exe
4412	schtasks.exe
3488	schtasks.exe
4336	schtasks.exe
3812	schtasks.exe
4608	schtasks.exe
4636	schtasks.exe
1160	schtasks.exe
5596	schtasks.exe
4736	schtasks.exe
4144	schtasks.exe
3672	schtasks.exe
4776	schtasks.exe
2272	schtasks.exe
3360	schtasks.exe
3648	schtasks.exe
3084	schtasks.exe
4856	schtasks.exe
2184	schtasks.exe
4120	schtasks.exe
3308	schtasks.exe
1520	schtasks.exe
5104	schtasks.exe
2104	schtasks.exe
1384	schtasks.exe
5416	schtasks.exe
3260	schtasks.exe
6076	schtasks.exe
2536	schtasks.exe
3184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
2536	powershell.exe
2536	powershell.exe
1384	powershell.exe
1384	powershell.exe
1200	powershell.exe
1200	powershell.exe
1368	powershell.exe
1368	powershell.exe
5228	powershell.exe
5044	powershell.exe
5044	powershell.exe
5228	powershell.exe
3068	powershell.exe
3068	powershell.exe
1160	powershell.exe
1160	powershell.exe
5320	powershell.exe
5320	powershell.exe
1500	powershell.exe
1500	powershell.exe
2896	powershell.exe
2896	powershell.exe
6056	powershell.exe
6056	powershell.exe
6028	powershell.exe
6028	powershell.exe
3000	powershell.exe
3000	powershell.exe
2632	powershell.exe
2632	powershell.exe
1220	powershell.exe
1220	powershell.exe
5236	powershell.exe
5236	powershell.exe
5084	powershell.exe
5084	powershell.exe
1520	powershell.exe
1520	powershell.exe
2572	powershell.exe
2572	powershell.exe
1384	powershell.exe
1384	powershell.exe
2536	powershell.exe
2536	powershell.exe
1200	powershell.exe
1200	powershell.exe
1368	powershell.exe
1160	powershell.exe
1220	powershell.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	5228	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	5320	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	6056	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	5236	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	3460	RuntimeBroker.exe
Token: SeDebugPrivilege	5680	RuntimeBroker.exe
Token: SeDebugPrivilege	3832	RuntimeBroker.exe
Token: SeDebugPrivilege	3068	RuntimeBroker.exe
Token: SeDebugPrivilege	4332	RuntimeBroker.exe
Token: SeDebugPrivilege	2680	RuntimeBroker.exe
Token: SeDebugPrivilege	3612	RuntimeBroker.exe
Token: SeDebugPrivilege	5992	RuntimeBroker.exe
Token: SeDebugPrivilege	3552	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 2572	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	158
PID 4324 wrote to memory of 2572	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	158
PID 4324 wrote to memory of 3000	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	159
PID 4324 wrote to memory of 3000	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	159
PID 4324 wrote to memory of 2896	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	207
PID 4324 wrote to memory of 2896	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	207
PID 4324 wrote to memory of 1220	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	161
PID 4324 wrote to memory of 1220	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	161
PID 4324 wrote to memory of 5228	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	163
PID 4324 wrote to memory of 5228	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	163
PID 4324 wrote to memory of 5084	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	164
PID 4324 wrote to memory of 5084	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	164
PID 4324 wrote to memory of 1500	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	165
PID 4324 wrote to memory of 1500	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	165
PID 4324 wrote to memory of 6056	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	166
PID 4324 wrote to memory of 6056	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	166
PID 4324 wrote to memory of 5236	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	167
PID 4324 wrote to memory of 5236	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	167
PID 4324 wrote to memory of 5044	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	168
PID 4324 wrote to memory of 5044	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	168
PID 4324 wrote to memory of 2632	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	169
PID 4324 wrote to memory of 2632	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	169
PID 4324 wrote to memory of 2536	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	170
PID 4324 wrote to memory of 2536	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	170
PID 4324 wrote to memory of 1200	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	171
PID 4324 wrote to memory of 1200	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	171
PID 4324 wrote to memory of 1160	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	172
PID 4324 wrote to memory of 1160	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	172
PID 4324 wrote to memory of 5320	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	173
PID 4324 wrote to memory of 5320	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	173
PID 4324 wrote to memory of 1368	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	174
PID 4324 wrote to memory of 1368	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	174
PID 4324 wrote to memory of 1384	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	175
PID 4324 wrote to memory of 1384	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	175
PID 4324 wrote to memory of 3068	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	213
PID 4324 wrote to memory of 3068	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	213
PID 4324 wrote to memory of 1520	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	177
PID 4324 wrote to memory of 1520	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	177
PID 4324 wrote to memory of 6028	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	178
PID 4324 wrote to memory of 6028	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	178
PID 4324 wrote to memory of 1880	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	198
PID 4324 wrote to memory of 1880	4324	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe	198
PID 1880 wrote to memory of 5380	1880	cmd.exe	200
PID 1880 wrote to memory of 5380	1880	cmd.exe	200
PID 1880 wrote to memory of 3460	1880	cmd.exe	201
PID 1880 wrote to memory of 3460	1880	cmd.exe	201
PID 3460 wrote to memory of 5784	3460	RuntimeBroker.exe	202
PID 3460 wrote to memory of 5784	3460	RuntimeBroker.exe	202
PID 3460 wrote to memory of 5304	3460	RuntimeBroker.exe	203
PID 3460 wrote to memory of 5304	3460	RuntimeBroker.exe	203
PID 5784 wrote to memory of 5680	5784	WScript.exe	205
PID 5784 wrote to memory of 5680	5784	WScript.exe	205
PID 5680 wrote to memory of 2896	5680	RuntimeBroker.exe	207
PID 5680 wrote to memory of 2896	5680	RuntimeBroker.exe	207
PID 5680 wrote to memory of 536	5680	RuntimeBroker.exe	208
PID 5680 wrote to memory of 536	5680	RuntimeBroker.exe	208
PID 2896 wrote to memory of 3832	2896	WScript.exe	210
PID 2896 wrote to memory of 3832	2896	WScript.exe	210
PID 3832 wrote to memory of 3508	3832	RuntimeBroker.exe	211
PID 3832 wrote to memory of 3508	3832	RuntimeBroker.exe	211
PID 3832 wrote to memory of 64	3832	RuntimeBroker.exe	212
PID 3832 wrote to memory of 64	3832	RuntimeBroker.exe	212
PID 3508 wrote to memory of 3068	3508	WScript.exe	213
PID 3508 wrote to memory of 3068	3508	WScript.exe	213

System policy modification 1 TTPs 30 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe
"C:\Users\Admin\AppData\Local\Temp\c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Start Menu\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\production\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Links\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\edge_BITS_4800_1922016304\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\edge_BITS_4764_811068770\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\900323d723f1dd1206\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\database\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Favorites\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\es-ES\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SbGbQBt3iN.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5380
- - C:\Users\Default\Links\RuntimeBroker.exe
    "C:\Users\Default\Links\RuntimeBroker.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3460
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e023659c-0a23-4fdc-bb97-bfef0513a463.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5784
    - - C:\Users\Default\Links\RuntimeBroker.exe
        
        C:\Users\Default\Links\RuntimeBroker.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5680
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\686eb96c-f5ac-410d-9bdb-df9a35a0c1f3.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Users\Default\Links\RuntimeBroker.exe
        
        C:\Users\Default\Links\RuntimeBroker.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3832
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f36d1935-d782-4eaf-a83f-1207fa473b07.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Users\Default\Links\RuntimeBroker.exe
        
        C:\Users\Default\Links\RuntimeBroker.exe
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e964fe4-a666-44b0-9480-edebe3cd2778.vbs"
        10⤵
        
        PID:1136
        
        C:\Users\Default\Links\RuntimeBroker.exe
        
        C:\Users\Default\Links\RuntimeBroker.exe
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b3057fd-120f-4e5c-b77f-f68498322512.vbs"
        12⤵
        
        PID:2324
        
        C:\Users\Default\Links\RuntimeBroker.exe
        
        C:\Users\Default\Links\RuntimeBroker.exe
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79a86d8c-7f01-4e52-99fa-55d987a83407.vbs"
        14⤵
        
        PID:3324
        
        C:\Users\Default\Links\RuntimeBroker.exe
        
        C:\Users\Default\Links\RuntimeBroker.exe
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11225541-210e-4b4d-a77f-30fa9569d52d.vbs"
        16⤵
        
        PID:5232
        
        C:\Users\Default\Links\RuntimeBroker.exe
        
        C:\Users\Default\Links\RuntimeBroker.exe
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7df06b13-213f-4c0c-8704-fc85be92aee4.vbs"
        18⤵
        
        PID:4348
        
        C:\Users\Default\Links\RuntimeBroker.exe
        
        C:\Users\Default\Links\RuntimeBroker.exe
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32015ddd-e1e1-4c59-8964-fb0578a082b1.vbs"
        20⤵
        
        PID:4468
        
        C:\Users\Default\Links\RuntimeBroker.exe
        
        C:\Users\Default\Links\RuntimeBroker.exe
        21⤵
        
        PID:5508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19d548c2-2ceb-4cd7-b64f-e5f8e77d1e1f.vbs"
        20⤵
        
        PID:5396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a770ef0f-70aa-4d48-bbc4-21d936ccba20.vbs"
        18⤵
        
        PID:1404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a7e88d6-d116-415b-88cf-65b2b30b6d00.vbs"
        16⤵
        
        PID:2860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f003485-42e1-453c-8414-ea4a0e5c91f0.vbs"
        14⤵
        
        PID:3956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\380bd207-2898-40df-a4db-7788ff0f4d4a.vbs"
        12⤵
        
        PID:2140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed22129e-a0ab-4b72-b0d3-addc8a573c1d.vbs"
        10⤵
        
        PID:3912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21d5ca9f-2925-4d30-81af-cf518ecfdb6f.vbs"
        8⤵
        
        PID:64
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2192fae-4d8d-4e0a-8572-08acc4c28d01.vbs"
        6⤵
        
        PID:536
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e728f76a-5214-48c2-a806-94d0c14352e9.vbs"
      4⤵
      PID:5304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Start Menu\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Start Menu\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\de-DE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\de-DE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\IdentityCRL\production\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\production\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Windows\IdentityCRL\production\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Links\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Links\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Links\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\edge_BITS_4800_1922016304\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4800_1922016304\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\edge_BITS_4800_1922016304\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\edge_BITS_4764_811068770\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4764_811068770\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\edge_BITS_4764_811068770\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\900323d723f1dd1206\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\900323d723f1dd1206\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\900323d723f1dd1206\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\security\database\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\security\database\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\security\database\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Favorites\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Favorites\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Favorites\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

Network

DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.ax-0001.ax-msedge.net

g-bing-com.ax-0001.ax-msedge.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.28.10

ax-0001.ax-msedge.net

IN A

150.171.27.10
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=19b87cedfbfa43b6a7b765201326d749&localId=w:21C1CCEE-160B-F796-E0D9-10C0675E4A84&deviceId=6825849400293996&anid=

Remote address:

150.171.28.10:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=19b87cedfbfa43b6a7b765201326d749&localId=w:21C1CCEE-160B-F796-E0D9-10C0675E4A84&deviceId=6825849400293996&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=27F54D2093CD6F5631465897922D6E73; domain=.bing.com; expires=Thu, 16-Apr-2026 06:32:48 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CA4B1AED28EF4DF5B024F15FF43B4DF7 Ref B: LON04EDGE1114 Ref C: 2025-03-22T06:32:48Z
date: Sat, 22 Mar 2025 06:32:47 GMT
GET

https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=19b87cedfbfa43b6a7b765201326d749&localId=w:21C1CCEE-160B-F796-E0D9-10C0675E4A84&deviceId=6825849400293996&anid=

Remote address:

150.171.28.10:443

Request

GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=19b87cedfbfa43b6a7b765201326d749&localId=w:21C1CCEE-160B-F796-E0D9-10C0675E4A84&deviceId=6825849400293996&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=27F54D2093CD6F5631465897922D6E73

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=L5TwwR2gPcCqQCDipxXqc2p2u_S4DnnYOjdSaW0DY2g; domain=.bing.com; expires=Thu, 16-Apr-2026 06:32:48 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6B680EA2B6CF4F1BA6B7DDF01AC0F47A Ref B: LON04EDGE1114 Ref C: 2025-03-22T06:32:48Z
date: Sat, 22 Mar 2025 06:32:47 GMT
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=19b87cedfbfa43b6a7b765201326d749&localId=w:21C1CCEE-160B-F796-E0D9-10C0675E4A84&deviceId=6825849400293996&anid=

Remote address:

150.171.28.10:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=19b87cedfbfa43b6a7b765201326d749&localId=w:21C1CCEE-160B-F796-E0D9-10C0675E4A84&deviceId=6825849400293996&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=27F54D2093CD6F5631465897922D6E73; MSPTC=L5TwwR2gPcCqQCDipxXqc2p2u_S4DnnYOjdSaW0DY2g

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F794C8D5E5724DA7A7FE171FB36AACE4 Ref B: LON04EDGE1114 Ref C: 2025-03-22T06:32:48Z
date: Sat, 22 Mar 2025 06:32:47 GMT
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.28.10

ax-0001.ax-msedge.net

IN A

150.171.27.10
GET

https://tse1.mm.bing.net/th?id=OADD2.10239355262897_1WRSJCEZM1EG3MR0G&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239355262897_1WRSJCEZM1EG3MR0G&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 356644
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BAA7DEBAC45F47748BDA603CA5DD775B Ref B: LON04EDGE1020 Ref C: 2025-03-22T06:32:49Z
date: Sat, 22 Mar 2025 06:32:48 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239360505011_123FH55PMWQ5EA6JP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239360505011_123FH55PMWQ5EA6JP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 1265436
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6D4B7B9399FE4590A98A5A9CC9A06202 Ref B: LON04EDGE1020 Ref C: 2025-03-22T06:32:49Z
date: Sat, 22 Mar 2025 06:32:48 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239355262898_1GZLH62E7DDOB6LZ5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239355262898_1GZLH62E7DDOB6LZ5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 1420323
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5DD90F516A0F4159BB12BCB14ACD1BBB Ref B: LON04EDGE1020 Ref C: 2025-03-22T06:32:49Z
date: Sat, 22 Mar 2025 06:32:48 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418569_13408TD3CSPQQLS8W&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239340418569_13408TD3CSPQQLS8W&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 815230
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5EE8CE84D4434BBBAB48E7F09119A910 Ref B: LON04EDGE1020 Ref C: 2025-03-22T06:32:49Z
date: Sat, 22 Mar 2025 06:32:48 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239360504960_1PLAHYZB4JQO28JRC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239360504960_1PLAHYZB4JQO28JRC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 540156
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AC5F004AFAE343AD8E8CEE653043ADD2 Ref B: LON04EDGE1020 Ref C: 2025-03-22T06:32:49Z
date: Sat, 22 Mar 2025 06:32:48 GMT
DNS

c.pki.goog

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A

Response

c.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.180.3
GET

http://c.pki.goog/r/r1.crl

Remote address:

142.250.180.3:80

Request

GET /r/r1.crl HTTP/1.1
Cache-Control: max-age = 3000
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog

Response

HTTP/1.1 304 Not Modified

Date: Sat, 22 Mar 2025 06:22:22 GMT
Expires: Sat, 22 Mar 2025 07:12:22 GMT
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Cache-Control: public, max-age=3000
Vary: Accept-Encoding
Age: 685

150.171.28.10:443

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=19b87cedfbfa43b6a7b765201326d749&localId=w:21C1CCEE-160B-F796-E0D9-10C0675E4A84&deviceId=6825849400293996&anid=

tls, http2

2.0kB
9.4kB
21
19

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=19b87cedfbfa43b6a7b765201326d749&localId=w:21C1CCEE-160B-F796-E0D9-10C0675E4A84&deviceId=6825849400293996&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=19b87cedfbfa43b6a7b765201326d749&localId=w:21C1CCEE-160B-F796-E0D9-10C0675E4A84&deviceId=6825849400293996&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=19b87cedfbfa43b6a7b765201326d749&localId=w:21C1CCEE-160B-F796-E0D9-10C0675E4A84&deviceId=6825849400293996&anid=

HTTP Response

204
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.1kB
6.9kB
14
13
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.1kB
6.9kB
14
13
150.171.28.10:443

https://tse1.mm.bing.net/th?id=OADD2.10239360504960_1PLAHYZB4JQO28JRC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

tls, http2

61.9kB
1.7MB
1249
1246

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239355262897_1WRSJCEZM1EG3MR0G&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239360505011_123FH55PMWQ5EA6JP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239355262898_1GZLH62E7DDOB6LZ5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418569_13408TD3CSPQQLS8W&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239360504960_1PLAHYZB4JQO28JRC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.1kB
6.9kB
14
13
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.1kB
6.9kB
14
13
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
142.250.180.3:80

http://c.pki.goog/r/r1.crl

http

476 B
394 B
6
4

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

304
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5
46.3.197.86:80

RuntimeBroker.exe

260 B
200 B
5
5

8.8.8.8:53

g.bing.com

dns

56 B
148 B
1
1

DNS Request

g.bing.com

DNS Response

150.171.28.10

150.171.27.10
8.8.8.8:53

tse1.mm.bing.net

dns

62 B
170 B
1
1

DNS Request

tse1.mm.bing.net

DNS Response

150.171.28.10

150.171.27.10
8.8.8.8:53

c.pki.goog

dns

56 B
107 B
1
1

DNS Request

c.pki.goog

DNS Response

142.250.180.3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\900323d723f1dd1206\fontdrvhost.exe

Filesize
1.9MB

MD5
fca8abc868649eaf842efc7c60f1bbff

SHA1
cf3d0e5c7aec4a47efbd9a80873a190efef3ae36

SHA256
15ae19ea3aefe972eed7564520c31afa1387ede58968c363304ce07d3845609f

SHA512
215425ce1d94330019b30e07be5250537fc3f687921992c01622ba0601ab5bfc6e5d31b829dff87affa90b0d50e56eabd3f39fccb9ff7d71e865e0a96462d09a

Download Submit
C:\Program Files (x86)\Windows Defender\es-ES\StartMenuExperienceHost.exe

Filesize
1.9MB

MD5
54e876194a72656d55cf51d24d5f8e23

SHA1
e7a06c22259857a5e4f4eb695d9bbbef018ce10c

SHA256
4b6d0a4bd6116957145a3faf9fffa9f23127c7ac23e2431a6d66c430ddc84965

SHA512
3dcdda0cf93550d36ee557e418bcb2243ca2b935488c56e8a08270d977bc94edefdead109cd56b1b013ec88e9c79ccbbba801699c5948e0d8670cb641261792b

Download Submit
C:\Program Files (x86)\Windows NT\fontdrvhost.exe

Filesize
1.9MB

MD5
7630d9db21435e52080a2bfc327b7c75

SHA1
fdb6cd9d550300bbad247af67fed2678a81bb70c

SHA256
de59bb08ccb27f1c218c2aa82c60583d658aa6054aaa48bb234a6a77abd618d7

SHA512
cd7f516ef758afd505824415b41411881387fab6cec5ff281259501dcfd8bd2815ef5d32007d1e6b3c09c591ebd0748d89b87c4d2d95464c46814f4593bfa629

Download Submit
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\RuntimeBroker.exe

Filesize
1.9MB

MD5
caff08f34b94bcb0be45d86151bfc93c

SHA1
ca60ff08e1f5c6ecc25e85c06a659a40f44f2d35

SHA256
b26a70090a3553b66426f3d6d1453b9ff068e374ea40e83b3c37c4593b647ccc

SHA512
0580eb9a29e800fbc08a055e5831bdb59384bf8052d84a61b473a6d538b0e62d45d4ef4c00fa6fd7976b7df78e34cd57de17743ec4482c0d47d946f03a5a911a

Download Submit
C:\Recovery\WindowsRE\Registry.exe

Filesize
1.9MB

MD5
451fd3f4b6a62f576c09e62164d82913

SHA1
d19fbc8ace74e14d0936b1b1fce61e1f69c8ce98

SHA256
6fef089a406911d20cc9519982208662b5636009c86248925f5e46c7ab1f8ce8

SHA512
4eb7cacd71a73a8063877c23287c6e504577b4746fe6cdab02824521ce3d30fe07f7fd013dc85d0b8dba48276b3dfe75949b2f5e167fc0984c00fdd5178b11cc

Download Submit
C:\Recovery\WindowsRE\Registry.exe

Filesize
1.9MB

MD5
8e079931976b660c64ddb79468d6075b

SHA1
e728c1b735c98351be645a68934edad1f52e09b3

SHA256
c855759c0f18039722a8c96ff1d7da64aa75aff9d72e254ae6a3f2de34c50428

SHA512
36e997cb6b10099db8271303d8b3f5fcb6166104720819afb2a257071e34dddb06d6f9178145680b4aa1712fa1e03d3ba9984cc900e6b42244bf2a3e3faa67e9

Download Submit
C:\Recovery\WindowsRE\services.exe

Filesize
1.9MB

MD5
24fbac9524d933691d357faf34e0027d

SHA1
db2a737d410174f07272085166e51c3285b9e910

SHA256
48cd0b33545355e61ce0195829ebe6a1b6ab43082e839cfc7f5b08f53c7ca822

SHA512
60dc4e9fc3cdc4e28c9eb6c2ee0812b93bad092ad6f85bacb60f92a53870465ad3805e5d91aab4adf7e8c2cc5977b8fc63f169b0a9fe0a80412d802fde6aa4d5

Download Submit
C:\Recovery\WindowsRE\winlogon.exe

Filesize
1.9MB

MD5
39722def789c11dab1a0b8ea58225390

SHA1
34e6a822e3bed8a620d4eb69fe0722f82ef7e3a8

SHA256
6b3f4976783fa57ab6e6b84bdd4e95ce99aeb008b6ea90eb93bb0e180c893ca8

SHA512
6c0857389b7f41b9fd991b3ed25a8230abbb6f55e74281f1d17fa22152554b131c9a5d90ce8798cf744652c3cd92fd942708258dad79752731d1c23203ab622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
364147c1feef3565925ea5b4ac701a01

SHA1
9a46393ac3ffad3bb3c8f0e074b65d68d75e21ef

SHA256
38cf1ab1146ad24e88763fc0508c2a99478d8428b453ba8c8b830d2883a4562b

SHA512
bfec1d3f22abd5668def189259deb4d919ceb4d51ac965d0baf9b6cf8bea0db680d49a2b8d0b75524cc04c7803cdfd91e484b31dc8ddc3ff47d1e5c59a9e35cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a5d93882341ce023d4569907c3bb0def

SHA1
db0998ab671abb543a7ac78596c0b95743a9a2c8

SHA256
c3ea7d8d4ac21adbe8c93e10729367b0b7c3477e7758596609c8e25e45baaa78

SHA512
7bf5716c96d93da7d37bbedb9623c9ae2860ac7b1a0e9310cbee0962556705f8876aebdabb9820f1f1ed37e504e002f24507a23db302d0e180bb45092520cc7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fb615e25fa5c5d81a46365d6446ed714

SHA1
a57ba54012b1fb1920cfcf276424556d6dc547fc

SHA256
61387deb1626bfef8716a58b204fe05f3df45181550ac38a081c97409c8973fc

SHA512
75961d4e10c7387ca20add4c96b2c4ebb897de417a18b6c6ac9008baa7c0d38823db4797d42e423225c09314ebfe8b000aa9f659f2e992ac8eba8a071407414e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c8fd95453fe0d2e0f6d8e5ac03994b1

SHA1
d9811cf9d2b0d0ce3387fd79462cd592b005a634

SHA256
232dac927d663f4ed67a4f005da093bc9865c323767c29c3b4a21797f4a60e58

SHA512
f334216c706e96e85910bc14e7eeec0da3e6f4e9a8620108c938d997266939170aabfdfddd9830f454a34d0db503f8f0bbe63c910007bfd03f294f8a34945810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
091f20bbaff3637ace005fce1590be7b

SHA1
00d1ef232fc560231ff81adc227a8f2918235a29

SHA256
bd50b50b5e08067840cf1e6bb16f3ed0242649d826544899056db26876dec9fe

SHA512
ebc04d7de6bcbd6505c60432c6455bde985ac422cbda875ef5c1dd6ef44155ec0d43a882dd793e692d3723a257e3d12c48ac8c0dad7c21a99d446d4b3b257890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0f29d4b03e157fa020f2b793683543af

SHA1
1b0603266b02dd38444489e0d5e18ee93b6b766a

SHA256
eec5516679b34fb0efe983a81cc19b0b5cf33fd3191d5d8fd5c3fb082a55d410

SHA512
b0cca3aa1373f813a7a16a1ca94b7e048d83f8875b28949d7ece9668c5cb847250d1468080a85e478833a8876b668a8a6e0ef4df4a289ca66badac3af00dc5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8e7675df15697eee65b731b90f33a5f

SHA1
8fe1308e032c5cb61b8ea50672fd650889cecdcd

SHA256
656a10810af26e008c2c5d4748b4a476b97b9fd5ef7837ae197feff6ec00b932

SHA512
fed3aa124a90998c734d36397f7fa6e26973bbeaa2c11b999ee05b0fb2378473b14765ca606f021c2f778613ce61f3a1c6836e955b7c6b192a7774973a945992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
566ef902c25833fe5f7f4484509fe364

SHA1
f8ba6651e7e4c64270e95aac690ad758fa3fc7f8

SHA256
28265aaf259c60ae208b025f4c6b317c0799154b5d40d650bf44ef09f4805514

SHA512
b2c696820b775c0705884f606b4ac464d75d8d5e415bee2fb1e68d07ca288c953936d9286f277082fc11fbae24748c6a872f0be540be37190f0383c7b16820a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
de3ba80caa50615acb96106e34d317cb

SHA1
38f3d5e39cdd18e80cc4295acd4658453eab4297

SHA256
ede1485afc45cccca56f0d392cd5af86f604719b09d5c550a1c49e8023125564

SHA512
12322effb7cd38b7b1a19bdd0ae733546b367f48c8b742824cb3aac6be594c9c601fcd69b10b8185bd8adb7f63c2a5ec013242e6ad678bf532e615a8d915bdb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
990f2ad22e4ee8bb16d0e84568ff1c04

SHA1
8ee103c2c4969dd252d3f136479e718361e2ace2

SHA256
9e058905555242348650ecae8008fd39cf63bac0f3160637aab912fd54fd2578

SHA512
ab70a31915f4241c23a020a0e1c8ad5b2468c06911ceb4418b5377619953780f14070a2674858b1a7d999b356448ffdb51db6393e56f20defb291866383f5802

Download Submit
C:\Users\Admin\AppData\Local\Temp\11225541-210e-4b4d-a77f-30fa9569d52d.vbs

Filesize
716B

MD5
f0b5d452f8fcfb5fb08134ef89eb0354

SHA1
39f12b4e3b91ad719f04fadd6fb42d984435efbd

SHA256
1ebfa210b8f1a60654b92d123cc0ff74e1dcabd25d072b3df2c32f987b29dd21

SHA512
ab3ec7457f9b1166474b3e124c9e23f6ff9bc89ad71352f0155b4960f6f7560f7754ccd1260c50ab677bbf0280cf575286679dea432ce39b96a2504936e9665f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1b3057fd-120f-4e5c-b77f-f68498322512.vbs

Filesize
716B

MD5
81fcbd33c933ddc36e73493197143050

SHA1
c470bcdae2ae52e53e84b51d3c9eab567625fc33

SHA256
47d34110a47f3ab742c0274b830c94773b216b6004c631272d497fcd64be149a

SHA512
3f964dd510f75d869fb70f68d54c6decee3a00e7cd543c4585e6e6f3bd60c0a4e262e262d572f0b6ef1fa15ad15058ffa84e7a06254952b1b7adf01170ba99f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\32015ddd-e1e1-4c59-8964-fb0578a082b1.vbs

Filesize
716B

MD5
461f2c58474fc5455ac6b6bdf59db163

SHA1
d63c32fff144ab182a5a8463249901074ecc5314

SHA256
ec76a804a8a0a500a322540a35c54be6a46966ffc8b0beab196ade23d8b1e25f

SHA512
ac9d60f176b52b092379af8538267fb428ccd5768102abba1e28f03658acd4f5e111ad78de210e0984334e89670d4cf55a129a7905f229918243a5166eac4f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\686eb96c-f5ac-410d-9bdb-df9a35a0c1f3.vbs

Filesize
716B

MD5
970f3f5c251c6e4c10d14a7e61646aff

SHA1
6b3a8d8118f13c5018b118601dc249cad2dab6fd

SHA256
5554a1fd049fbdf33ca5a7d0d7b88465d9faecb236501f5548d5242f605d88cc

SHA512
f2ef972ad4ecb6868302de85a0b3a524e3ec86b033991f07187bec004b7308c91b1ad58d5cf855726b42c3f6b6cbc46616ce51e9f36e05e229fc51a5dfdcadeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\79a86d8c-7f01-4e52-99fa-55d987a83407.vbs

Filesize
716B

MD5
a9e58909a32c449db0ee85ac53833472

SHA1
56cceef5d5fb9e6c62364dabf6d17c3782f61386

SHA256
10809a26a162c8a368b1a83928a82ae61dc7137af5bb1e68692e5370ff7642f4

SHA512
69b32cd9f19ccb1ed8fe78e42fb8bc251218f3fa3715c83d29f22af6f1a03cdb7474a9341cd1d2e6fe9e52d6b71df89232c5a9ef109459a24c32b5ce5a222c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\7df06b13-213f-4c0c-8704-fc85be92aee4.vbs

Filesize
716B

MD5
a9e81bac09fcd0d9a10e27874f231e65

SHA1
f076ca00768356dfd1681beb9f9994eda9eb8a61

SHA256
ce8147a2ef05e758b5be5b62c3c6e744cef99d66091d4d7922d0a7e918840efb

SHA512
2dda53f76d5cc4c7937096db0cb699a16cffce03ec852fb9c0a690352ca2cd8aa374e3ea4101b09a8815f95871598c55a1d5ccb56d11f035e8b99a0756f89e83

Download Submit
C:\Users\Admin\AppData\Local\Temp\9e964fe4-a666-44b0-9480-edebe3cd2778.vbs

Filesize
716B

MD5
88a3b8d1f55ca7da4634a7b9f488d407

SHA1
c15b86f3ef0efe0f673139c2104c4a3767bfe886

SHA256
156c1524e341bfa86826f9c92d93089311b1858a563f0dc02123b12943d9d6d5

SHA512
39f1e8b8f681c4ad6fc4a78d43bebe2cbbfb815d65383942b8edfe281ea38cec227428ac30f104af1ca3b751eb8d1dbc3a77602ccca3e99003a10f3851269d28

Download Submit
C:\Users\Admin\AppData\Local\Temp\SbGbQBt3iN.bat

Filesize
205B

MD5
88a291c77467ae10699ce0ba99ca5479

SHA1
67eba972a79761d3fed8a4b56e59cbb7ec7c886e

SHA256
083a3d98449c33e63631b381dd16730491179ec14ddd88cd2c79c9b904b14267

SHA512
933ade313fecc77b071cc3eece1b8ca2ed747abfa4f6ec913bc078ca24e0b781f1b8430111007ada2b72499dea61784e96bb281db4c9efc6492713072b5091d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wco4dxne.u05.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e023659c-0a23-4fdc-bb97-bfef0513a463.vbs

Filesize
716B

MD5
9c67aa0f7d862fa1b4a8427dbe1baf5d

SHA1
14ca3b373c17bcde9a2d75b116b39d2ae0bd2fc3

SHA256
55a87e0c9b28210ee989756781f0bc6d40c5274b38f31b78b9c3540eff1087fc

SHA512
d84e9137aaca99e7590c1ff8c2255c41d8272aaabd45c8b29f908d291c6cd2e2e06ef0c9ab38337407eddd347653cbda6c5fbc7bd79370413d0f25e70f840e45

Download Submit
C:\Users\Admin\AppData\Local\Temp\e728f76a-5214-48c2-a806-94d0c14352e9.vbs

Filesize
492B

MD5
6c43770c633c6474695232b102f6b63d

SHA1
c513f30d5d3629af4db60ed0f993ec3f340dfe4a

SHA256
22671a5b6fe9205a85c9d182aa2c71e76a06f2ec12f81b8ddf49689da31367d5

SHA512
423ad7f505d16571fbcc2eab6f0da1a04f93b42f74ed9a4a7207c0a7bdf19e0e6a0e4d2066b56ac4403ec1c57068e61e82bfe7c4af71a363f73e7e04cf207806

Download Submit
C:\Users\Admin\AppData\Local\Temp\f36d1935-d782-4eaf-a83f-1207fa473b07.vbs

Filesize
716B

MD5
aef6113d0489ebf93b42bd13d03ed97d

SHA1
9d9f9d2efcd49a7b43b52962dff8dce9e16a2b56

SHA256
02032d654ae86a85413ffbc9ecfe36bb2ed67e2dd9e0e0c7c5b29f4179a261e3

SHA512
44670a468f87a7ac9a6686fe1a2b8ce19f5d6f83b3dc7d379da70ce04ac8dc9d6ed1e7ba98c8325d2459c7fe5a0f366c289d3b1136526cdd9446a0c287c99d57

Download Submit
C:\Users\Default\Links\RuntimeBroker.exe

Filesize
1.9MB

MD5
998120087e4a2113da45fb3bd689434d

SHA1
af0b217170b746dc076ba6286be591cd52f48c41

SHA256
89bc9d7fcbab84fd5ce384b8fcdb78a2212499dcf67533cbbbec5258a7b6eff6

SHA512
c7e50a52f2b188fbe1f6c1f3a6f88cabc74b42cb7290220937f625459fde0ac87d5ae3bdec05455b37b1b09e67d71530df7bf41ce26aa933743427d77cb103b8

Download Submit
C:\Windows\IdentityCRL\production\taskhostw.exe

Filesize
1.9MB

MD5
0a899b73172c64c1021f79f0ba72c5c0

SHA1
f095b918e0cce6d76be451d88e05a67bb7e4eaf8

SHA256
7a8dc4a72a578558f441e47f9a620b90b5509b4cbe83ca11f1c301ad604be574

SHA512
82704bb2905207e7c0256862806801bf3d03c360da67cee20a2f8cf07c8818e012e8b36ec961cf534ca62871c9e0c4eaaab19d66b294bc9a4025c90975403312

Download Submit
memory/2536-298-0x000001ED825E0000-0x000001ED82602000-memory.dmp

Filesize
136KB

Download
memory/3460-515-0x0000000000F50000-0x000000000113A000-memory.dmp

Filesize
1.9MB

Download
memory/3552-606-0x000000001C9B0000-0x000000001CA06000-memory.dmp

Filesize
344KB

Download
memory/3612-583-0x000000001D5B0000-0x000000001D5C2000-memory.dmp

Filesize
72KB

Download
memory/4324-6-0x00000000033C0000-0x00000000033D0000-memory.dmp

Filesize
64KB

Download
memory/4324-20-0x000000001C640000-0x000000001C64C000-memory.dmp

Filesize
48KB

Download
memory/4324-3-0x0000000001A20000-0x0000000001A3C000-memory.dmp

Filesize
112KB

Download
memory/4324-4-0x000000001C390000-0x000000001C3E0000-memory.dmp

Filesize
320KB

Download
memory/4324-5-0x00000000033B0000-0x00000000033B8000-memory.dmp

Filesize
32KB

Download
memory/4324-7-0x000000001C340000-0x000000001C356000-memory.dmp

Filesize
88KB

Download
memory/4324-8-0x00000000033D0000-0x00000000033DA000-memory.dmp

Filesize
40KB

Download
memory/4324-1-0x0000000000E80000-0x000000000106A000-memory.dmp

Filesize
1.9MB

Download
memory/4324-288-0x00007FFAE7600000-0x00007FFAE80C1000-memory.dmp

Filesize
10.8MB

Download
memory/4324-2-0x00007FFAE7600000-0x00007FFAE80C1000-memory.dmp

Filesize
10.8MB

Download
memory/4324-15-0x000000001C380000-0x000000001C38C000-memory.dmp

Filesize
48KB

Download
memory/4324-11-0x000000001C360000-0x000000001C368000-memory.dmp

Filesize
32KB

Download
memory/4324-0-0x00007FFAE7603000-0x00007FFAE7605000-memory.dmp

Filesize
8KB

Download
memory/4324-10-0x000000001BCB0000-0x000000001BCBC000-memory.dmp

Filesize
48KB

Download
memory/4324-9-0x000000001C3E0000-0x000000001C436000-memory.dmp

Filesize
344KB

Download
memory/4324-16-0x000000001C600000-0x000000001C60A000-memory.dmp

Filesize
40KB

Download
memory/4324-14-0x000000001CE70000-0x000000001D398000-memory.dmp

Filesize
5.2MB

Download
memory/4324-17-0x000000001C610000-0x000000001C61E000-memory.dmp

Filesize
56KB

Download
memory/4324-201-0x00007FFAE7603000-0x00007FFAE7605000-memory.dmp

Filesize
8KB

Download
memory/4324-219-0x00007FFAE7600000-0x00007FFAE80C1000-memory.dmp

Filesize
10.8MB

Download
memory/4324-19-0x000000001C630000-0x000000001C63C000-memory.dmp

Filesize
48KB

Download
memory/4324-18-0x000000001C620000-0x000000001C628000-memory.dmp

Filesize
32KB

Download
memory/4324-13-0x000000001C370000-0x000000001C382000-memory.dmp

Filesize
72KB

Download
memory/4332-560-0x000000001AFF0000-0x000000001B002000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.